chore: bump version to 3.3.13

Co-authored-by: Codex <noreply@openai.com>

.github/workflows/_container.yml

@@ -79,7 +79,7 @@ jobs:
           ${{ hashFiles('trivy-results.sarif') != '' &&
               (github.event_name != 'pull_request' ||
                github.event.pull_request.head.repo.full_name == github.repository) }}
-        uses: github/codeql-action/upload-sarif@db488ddef3bf6cb639b32c2e9a7c0a7ea8271d28 # v4.37.8
+        uses: github/codeql-action/upload-sarif@cdf488f595d80d6e07e03d4674febd5ab45fa938 # v4.37.9
         with:
           sarif_file: trivy-results.sarif
           category: runtime-container

.github/workflows/ci.yml

@@ -4,6 +4,8 @@ on:
   push:
     branches:
       - main
+    paths-ignore:
+      - 'release/version.yaml'
   pull_request:
     branches:
       - main

.github/workflows/release.yml

@@ -163,6 +163,15 @@ jobs:
       ref: ${{ needs.release-info.outputs.git_sha }}
       upload_frontend: true
 
+  container:
+    needs: [release-info]
+    permissions:
+      contents: read
+      security-events: write
+    uses: ./.github/workflows/_container.yml
+    with:
+      ref: ${{ needs.release-info.outputs.git_sha }}
+
   build-docker-binary:
     name: build-docker-binary (${{ matrix.os }}-${{ matrix.arch }})
     needs: release-info
@@ -497,7 +506,7 @@ jobs:
           exit-code: '1'
 
   publish:
-    needs: [release-info, package-assets, build-docker-image]
+    needs: [release-info, package-assets, build-docker-image, container]
     runs-on: ubuntu-latest
     timeout-minutes: 20
     permissions:

backend/Cargo.lock

@@ -49,13 +49,13 @@ checksum = "03918c3dbd7701a85c6b9887732e2921175f26c350b4563841d0958c21d57e6d"
 
 [[package]]
 name = "argon2"
-version = "0.5.3"
+version = "0.6.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c3610892ee6e0cbce8ae2700349fcf8f98adb0dbfbee85aec3c9179d29cc072"
+checksum = "134c52ddac6d63c576bef8168db10c83c49c26444ecbc68060fef078925a901c"
 dependencies = [
  "base64ct",
  "blake2",
- "cpufeatures 0.2.17",
+ "cpufeatures 0.3.0",
  "password-hash",
 ]
 
@@ -116,7 +116,7 @@ checksum = "82f6aeea286b8eb4dd3431a1be1b59d290ace00f5bfd8e2a159bc2a05e2c1667"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -206,9 +206,9 @@ dependencies = [
 
 [[package]]
 name = "aws-sdk-s3"
-version = "1.142.0"
+version = "1.144.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "f9e15a5c55e05f4b0b7e483160b3c85cccdf77cff02c95504f3e71d460855cd2"
+checksum = "30dc8bf6baaf7d46336a0ca2c69f223d9b90d7a801fb3e28f7ea17b00dc6b1de"
 dependencies = [
  "arc-swap",
  "aws-credential-types",
@@ -331,9 +331,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-http-client"
-version = "1.3.0"
+version = "1.4.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "3c1c8a04cb31ba74d0115af5a890bb8c0d48fba64b52812fa13929a6ef0cc83c"
+checksum = "ebfd138fac0337cee7516c352757ea73b9f2266e57d0bcb5bc70e9547e45aef1"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-runtime-api",
@@ -375,9 +375,9 @@ dependencies = [
 
 [[package]]
 name = "aws-smithy-runtime"
-version = "1.13.1"
+version = "1.14.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "483b858ff67522011c4786310c5cd8fd88d0be7ea3d5f1a48328446300c4269e"
+checksum = "b82e438d30e02a825d363bd639a9efaed68a8089d86101054b0081e7e0d3e606"
 dependencies = [
  "aws-smithy-async",
  "aws-smithy-http",
@@ -599,11 +599,11 @@ dependencies = [
 
 [[package]]
 name = "blake2"
-version = "0.10.6"
+version = "0.11.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "46502ad458c9a52b69d4d4d32775c788b7a1b85e8bc9d482d92250fc0e3f8efe"
+checksum = "5b5d4d889834ee8ecfc0f8426ad30faf7cdcb10f741a8e6d7224d95325479f6f"
 dependencies = [
- "digest 0.10.7",
+ "digest 0.11.3",
 ]
 
 [[package]]
@@ -740,7 +740,7 @@ dependencies = [
  "provider-xai",
  "serde",
  "serde_json",
- "syn 3.0.3",
+ "syn 3.0.4",
  "tempfile",
  "thiserror",
  "tokio",
@@ -1013,7 +1013,6 @@ checksum = "9ed9a281f7bc9b7576e61468ba615a66a5c8cfdff42420a70aa82701a3b1e292"
 dependencies = [
  "block-buffer 0.10.4",
  "crypto-common 0.1.7",
- "subtle",
 ]
 
 [[package]]
@@ -1318,7 +1317,7 @@ checksum = "9fb9654ba8355388abeb8dcb4fc62f511300867002afc858860463bdd9fe0c44"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -1363,6 +1362,7 @@ dependencies = [
  "argon2",
  "async-trait",
  "base64 0.23.1",
+ "bytes",
  "chrono",
  "chrono-tz",
  "cron",
@@ -1586,6 +1586,11 @@ name = "hashbrown"
 version = "0.17.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "ed5909b6e89a2db4456e54cd5f673791d7eca6732202bbf2a9cc504fe2f9b84a"
+dependencies = [
+ "allocator-api2",
+ "equivalent",
+ "foldhash",
+]
 
 [[package]]
 name = "hashlink"
@@ -2046,11 +2051,11 @@ checksum = "0ceec5bc11778974d1bcb055b18002eba7f4b3518b6a0081b3af5f21666da9ad"
 
 [[package]]
 name = "lru"
-version = "0.16.4"
+version = "0.18.3"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "7f66e8d5d03f609abc3a39e6f08e4164ebf1447a732906d39eb9b99b7919ef39"
+checksum = "0d317b4b9eb398e6acce275758ec6125535505e7a146fb1a9b8bda2451b0ff4c"
 dependencies = [
- "hashbrown 0.16.1",
+ "hashbrown 0.17.1",
 ]
 
 [[package]]
@@ -2232,13 +2237,12 @@ dependencies = [
 
 [[package]]
 name = "password-hash"
-version = "0.5.0"
+version = "0.6.1"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "346f04948ba92c43e8469c1ee6736c7563d71012b17d40745260fe106aac2166"
+checksum = "aab41826031698d6ffcd9cff78ef56ef998e39dc7e5067cdfebe373842d4723b"
 dependencies = [
- "base64ct",
- "rand_core 0.6.4",
- "subtle",
+ "getrandom 0.4.3",
+ "phc",
 ]
 
 [[package]]
@@ -2262,6 +2266,17 @@ version = "2.3.2"
 source = "registry+https://github.com/rust-lang/crates.io-index"
 checksum = "9b4f627cb1b25917193a259e49bdad08f671f8d9708acfd5fe0a8c1455d87220"
 
+[[package]]
+name = "phc"
+version = "0.6.1"
+source = "registry+https://github.com/rust-lang/crates.io-index"
+checksum = "44dc769b75f93afdddd8c7fa12d685292ddeff1e66f7f0f3a234cf1818afe892"
+dependencies = [
+ "base64ct",
+ "ctutils",
+ "getrandom 0.4.3",
+]
+
 [[package]]
 name = "phf"
 version = "0.11.3"
@@ -2982,7 +2997,7 @@ checksum = "e7a5d71263a5a7d47b41f6b3f06ba276f10cc18b0931f1799f710578e2309348"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3407,9 +3422,9 @@ dependencies = [
 
 [[package]]
 name = "syn"
-version = "3.0.3"
+version = "3.0.4"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "53e9bae58849f64dfa4f5d5ae372c8341f7305f82a3868709269343628b659a3"
+checksum = "e6275cddf4610d1775e6d1fe9469b2e77d0f39fd98fb7450901b821e0c53649f"
 dependencies = [
  "proc-macro2",
  "quote",
@@ -3477,7 +3492,7 @@ checksum = "bc04cd3e1236dd4a98afca4569f2deb3f120e5422a4023be2cb683f8486292af"
 dependencies = [
  "proc-macro2",
  "quote",
- "syn 3.0.3",
+ "syn 3.0.4",
 ]
 
 [[package]]
@@ -3913,9 +3928,9 @@ checksum = "b6c140620e7ffbb22c2dee59cafe6084a59b5ffc27a8859a5f0d494b5d52b6be"
 
 [[package]]
 name = "uuid"
-version = "1.24.1"
+version = "1.26.0"
 source = "registry+https://github.com/rust-lang/crates.io-index"
-checksum = "2cefc03fd367c0c6d4305de1b312cf00248c4114f4a0418ce6a6af769e3b0bd9"
+checksum = "b5772d71c9be8a8a6ac2117d949c5b224c1b72241bb611d9a3012edcf8af7812"
 dependencies = [
  "getrandom 0.4.3",
  "js-sys",

backend/apps/gateway/tests/bootstrap.rs

@@ -144,7 +144,7 @@ fn config_loader_should_reject_removed_fingerprint_section() {
 #[test]
 fn config_loader_should_reject_invalid_codex_cli_version() {
     assert_rejected(valid_config().replace(
-        "codex_version: '0.147.0-alpha.6.6'",
+        "codex_version: '0.151.0-alpha.7.2'",
         "codex_version: 'latest'",
     ));
 }
@@ -165,7 +165,7 @@ fn config_loader_should_reject_zero_server_port() {
 
 #[test]
 fn config_loader_should_reject_invalid_desktop_profile_fields() {
-    assert_rejected(valid_config().replace("desktop_build: '6415'", "desktop_build: 'build'"));
+    assert_rejected(valid_config().replace("desktop_build: '7377'", "desktop_build: 'build'"));
 }
 
 fn assert_rejected(config: String) {

backend/crates/gateway-admin/Cargo.toml

@@ -12,9 +12,10 @@ name = "main"
 path = "tests/main.rs"
 
 [dependencies]
-argon2 = "0.5.3"
+argon2 = "0.6.0"
 async-trait = "0.1.89"
 base64 = "0.23.0"
+bytes = "1.11.1"
 chrono = "0.4.45"
 futures = "0.3.32"
 gateway-core = { path = "../gateway-core" }

backend/crates/gateway-admin/src/model/observability.rs

@@ -135,6 +135,7 @@ pub struct OpsErrorFilter {
     pub provider_kind: Option<String>,
     pub provider_account_ref: Option<String>,
     pub operation: Option<String>,
+    pub endpoint: Option<String>,
     pub model: Option<String>,
     pub transport: Option<String>,
     pub attempt_index: Option<u32>,
@@ -762,6 +763,10 @@ pub struct OpsError {
     pub client_api_key_ref: Option<String>,
     pub component: String,
     pub operation: String,
+    pub protocol: Option<String>,
+    pub client_transport: Option<String>,
+    pub requested_model_id: Option<String>,
+    pub service_tier: Option<String>,
     pub endpoint: Option<String>,
     pub provider_kind: Option<String>,
     pub provider_account_ref: Option<String>,
@@ -779,6 +784,13 @@ pub struct OpsError {
     pub latency_ms: Option<u64>,
     pub message: String,
     pub occurrence_count: u32,
+    pub client_ip: Option<String>,
+    pub user_agent: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_preset: Option<String>,
+    pub request_kind: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub compact: Option<bool>,
     pub occurred_at: DateTime<Utc>,
     pub stable_sort_id: String,
 }

backend/crates/gateway-admin/src/model/provider_credentials.rs

@@ -1,9 +1,11 @@
 //! Provider 管理能力交换的中立 Command 与 Result。
 
-use std::fmt;
+use std::{fmt, pin::Pin};
 
 use async_trait::async_trait;
+use bytes::Bytes;
 use chrono::{DateTime, NaiveDate, Utc};
+use futures::Stream;
 use gateway_core::{
     engine::credential::{OpaqueProviderData, ProviderAccountId, ProviderAccountIdentity},
     routing::{ProviderKind, UpstreamModelId},
@@ -679,6 +681,35 @@ pub struct ProviderProfileStatistics {
     pub activity_insights: ProviderProfileActivityInsights,
 }
 
+/// Provider 头像正文的中立字节流；公共层不解释 MIME，也不限制总字节数。
+pub type ProviderProfileAvatarStream =
+    Pin<Box<dyn Stream<Item = Result<Bytes, ProviderProfileAvatarStreamError>> + Send + 'static>>;
+
+/// Provider 头像流在响应开始后的通用失败，不携带上游 URL 或正文。
+#[derive(Debug, thiserror::Error)]
+#[error("provider profile avatar stream failed")]
+pub struct ProviderProfileAvatarStreamError;
+
+/// Provider 已校验并打开的官方头像响应。
+pub struct ProviderProfileAvatar {
+    pub content_type: Option<String>,
+    pub content_length: Option<u64>,
+    pub etag: Option<String>,
+    pub body: ProviderProfileAvatarStream,
+}
+
+impl fmt::Debug for ProviderProfileAvatar {
+    fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
+        formatter
+            .debug_struct("ProviderProfileAvatar")
+            .field("content_type", &self.content_type)
+            .field("content_length", &self.content_length)
+            .field("etag", &self.etag)
+            .field("body", &"<stream>")
+            .finish()
+    }
+}
+
 /// Provider 返回的一张安全主动额度重置卡。
 #[derive(Debug, Clone, PartialEq, Eq)]
 pub struct ProviderResetCredit {

backend/crates/gateway-admin/src/ports/provider.rs

@@ -17,8 +17,8 @@ use crate::model::provider_credentials::{
     PendingAuthorizationMutation, PrepareCredentialImport, PrepareCredentialRefresh,
     PrepareCredentialRotation, PreparedAuthorizationCommit, PreparedCredentialImport,
     PreparedCredentialRotation, ProviderExport, ProviderExportCredentialInput, ProviderModels,
-    ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderResetCreditResult,
-    ProviderResetCredits,
+    ProviderProfileAvatar, ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest,
+    ProviderResetCreditResult, ProviderResetCredits,
 };
 
 /// Provider 管理失败的稳定分类。
@@ -157,6 +157,14 @@ pub trait ProviderAdmin: Send + Sync {
         Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
     }
 
+    /// 打开 Provider 官方头像字节流；不支持该能力的 Provider 使用默认拒绝。
+    async fn profile_avatar(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileAvatar, ProviderAdminError> {
+        Err(ProviderAdminError::new(ProviderAdminErrorKind::Unsupported))
+    }
+
     /// 查询 Provider 主动额度重置卡；不支持该能力的 Provider 使用默认拒绝。
     async fn reset_credits(
         &self,

backend/crates/gateway-admin/src/use_case/accounts.rs

@@ -25,8 +25,9 @@ use crate::{
         provider_credentials::{
             AccountDirectoryItem, AccountDirectoryPage, AccountExportBundle, AccountRefreshResult,
             ConsumeProviderResetCredit, PrepareCredentialRefresh, ProviderModels,
-            ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow,
-            ProviderResetCreditResult, ProviderResetCredits, QuotaLocalUsageAttribution,
+            ProviderProfileAvatar, ProviderProfileStatistics, ProviderQuota, ProviderQuotaRequest,
+            ProviderQuotaWindow, ProviderResetCreditResult, ProviderResetCredits,
+            QuotaLocalUsageAttribution,
         },
     },
     ports::{
@@ -90,6 +91,13 @@ pub trait AccountsService: Send + Sync {
         Err(AdminError::invalid("当前 Provider 不支持账号统计"))
     }
 
+    async fn profile_avatar(
+        &self,
+        _account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileAvatar, AdminError> {
+        Err(AdminError::invalid("当前 Provider 不支持账号头像"))
+    }
+
     async fn reset_credits(
         &self,
         _context: &MutationContext,
@@ -566,6 +574,17 @@ impl AccountsService for DefaultAccountsService {
             .map_err(|error| map_provider_error(error, "provider profile statistics"))
     }
 
+    async fn profile_avatar(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileAvatar, AdminError> {
+        let (_, provider) = self.provider_for_account(account_id).await?;
+        provider
+            .profile_avatar(account_id)
+            .await
+            .map_err(|error| map_provider_error(error, "provider profile avatar"))
+    }
+
     async fn reset_credits(
         &self,
         context: &MutationContext,

backend/crates/gateway-admin/src/use_case/auth.rs

@@ -2,7 +2,7 @@
 
 use std::sync::Arc;
 
-use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier, password_hash::SaltString};
+use argon2::{Argon2, PasswordHash, PasswordHasher, PasswordVerifier};
 use async_trait::async_trait;
 use base64::{Engine as _, engine::general_purpose::URL_SAFE_NO_PAD};
 use chrono::{Duration, Utc};
@@ -195,9 +195,8 @@ impl AuthService for DefaultAuthService {
 }
 
 fn hash_admin_password(password: &str) -> Result<String, AdminError> {
-    let salt = SaltString::generate(&mut OsRng);
     Argon2::default()
-        .hash_password(password.as_bytes(), &salt)
+        .hash_password(password.as_bytes())
         .map(|hash| hash.to_string())
         .map_err(|_| AdminError::internal("管理员密码哈希失败"))
 }

backend/crates/gateway-api/src/admin/accounts.rs

@@ -4,8 +4,9 @@ use std::{collections::BTreeSet, convert::Infallible, fmt};
 
 use axum::{
     Router,
+    body::Body,
     extract::State,
-    http::{HeaderValue, StatusCode, header::CACHE_CONTROL},
+    http::{HeaderName, HeaderValue, StatusCode, header},
     response::{
         IntoResponse, Response,
         sse::{Event, KeepAlive, Sse},
@@ -28,10 +29,10 @@ use gateway_admin::model::{
         AuthorizationStarted, CompleteAuthorization, ConsumeProviderResetCredit,
         CredentialDeletion, CredentialDeletionResult, CredentialImportResult, CredentialMutation,
         CredentialMutationResult, ImportCredentials, ProviderDocument, ProviderModels,
-        ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
-        ProviderProfileStatistics, ProviderProfileStatisticsSummary, ProviderQuota,
-        ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
-        RotateCredential, StartAuthorization,
+        ProviderProfileActivityInsights, ProviderProfileAvatar, ProviderProfileDailyUsage,
+        ProviderProfileInvocation, ProviderProfileStatistics, ProviderProfileStatisticsSummary,
+        ProviderQuota, ProviderQuotaWindow, ProviderResetCredit, ProviderResetCreditResult,
+        ProviderResetCredits, RotateCredential, StartAuthorization,
     },
 };
 use gateway_core::{
@@ -60,6 +61,7 @@ const MAX_ID_TOKEN_BYTES: usize = 16 * 1024;
 const MAX_CALLBACK_URL_BYTES: usize = 64 * 1024;
 const MAX_ACCOUNT_DELETE_BATCH: usize = 200;
 const MAX_ACCOUNT_GROUP_BATCH: usize = 1000;
+const MAX_AVATAR_VERSION_BYTES: usize = 32;
 
 /// 账号列表查询参数。
 #[derive(Debug, Clone, Default, Deserialize)]
@@ -422,6 +424,33 @@ impl AccountIdQuery {
     }
 }
 
+/// 头像 GET 的固定 query；`version` 只参与浏览器缓存键，不进入上游请求。
+#[derive(Debug, Clone, Deserialize)]
+#[serde(rename_all = "camelCase", deny_unknown_fields)]
+pub struct AccountProfileAvatarQuery {
+    pub account_id: String,
+    pub version: Option<String>,
+}
+
+impl AccountProfileAvatarQuery {
+    pub fn validate(&self) -> Result<(), WireValidationError> {
+        require_account_id(&self.account_id, "accountId")?;
+        if self.version.as_deref().is_some_and(|version| {
+            version.is_empty()
+                || version.len() > MAX_AVATAR_VERSION_BYTES
+                || !version.bytes().all(|byte| byte.is_ascii_alphanumeric())
+        }) {
+            return Err(WireValidationError::new("version"));
+        }
+        Ok(())
+    }
+
+    fn into_id(self) -> Result<ProviderAccountId, WireValidationError> {
+        self.validate()?;
+        ProviderAccountId::new(self.account_id).map_err(|_| WireValidationError::new("accountId"))
+    }
+}
+
 /// 敏感导出的固定 query；IDs 使用逗号分隔，禁止隐式导出全部账号。
 #[derive(Debug, Clone, Deserialize)]
 #[serde(rename_all = "camelCase", deny_unknown_fields)]
@@ -1291,6 +1320,10 @@ where
             "/api/admin/accounts/profile-statistics",
             get(account_profile_statistics::<S>),
         )
+        .route(
+            "/api/admin/accounts/profile-avatar",
+            get(account_profile_avatar::<S>),
+        )
         .route(
             "/api/admin/accounts/reset-credits",
             get(account_reset_credits::<S>).post(consume_account_reset_credit::<S>),
@@ -1400,7 +1433,7 @@ where
     let mut response = AdminResponse::new(StatusCode::OK, AdminEnvelope::ok(data)).into_response();
     response
         .headers_mut()
-        .insert(CACHE_CONTROL, HeaderValue::from_static("no-store"));
+        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
     Ok(response)
 }
 
@@ -1646,6 +1679,69 @@ where
     ))
 }
 
+async fn account_profile_avatar<S>(
+    _auth: AdminAuth,
+    State(state): State<S>,
+    AdminQuery(query): AdminQuery<AccountProfileAvatarQuery>,
+) -> Result<Response, AdminError>
+where
+    S: AdminSessionState + Send + Sync,
+{
+    let account_id = query.into_id().map_err(map_wire_error)?;
+    let avatar = state
+        .admin_services()
+        .accounts()
+        .profile_avatar(&account_id)
+        .await
+        .map_err(map_service_error)?;
+    Ok(profile_avatar_response(avatar))
+}
+
+/// 将 Provider 头像流投影为受保护的同源 HTTP 响应。
+#[must_use]
+pub fn profile_avatar_response(avatar: ProviderProfileAvatar) -> Response {
+    let ProviderProfileAvatar {
+        content_type,
+        content_length,
+        etag,
+        body,
+    } = avatar;
+    let mut response = Response::new(Body::from_stream(body));
+    *response.status_mut() = StatusCode::OK;
+    let headers = response.headers_mut();
+    headers.insert(
+        header::CONTENT_TYPE,
+        content_type
+            .and_then(|value| HeaderValue::from_str(&value).ok())
+            .unwrap_or_else(|| HeaderValue::from_static("application/octet-stream")),
+    );
+    if let Some(value) =
+        content_length.and_then(|length| HeaderValue::from_str(&length.to_string()).ok())
+    {
+        headers.insert(header::CONTENT_LENGTH, value);
+    }
+    if let Some(value) = etag.and_then(|value| HeaderValue::from_str(&value).ok()) {
+        headers.insert(header::ETAG, value);
+    }
+    headers.insert(
+        header::CACHE_CONTROL,
+        HeaderValue::from_static("private, max-age=3600"),
+    );
+    headers.insert(
+        HeaderName::from_static("x-content-type-options"),
+        HeaderValue::from_static("nosniff"),
+    );
+    headers.insert(
+        HeaderName::from_static("cross-origin-resource-policy"),
+        HeaderValue::from_static("same-origin"),
+    );
+    headers.insert(
+        HeaderName::from_static("content-security-policy"),
+        HeaderValue::from_static("sandbox; default-src 'none'"),
+    );
+    response
+}
+
 async fn refresh_account_quota<S>(
     _auth: AdminAuth,
     State(state): State<S>,

backend/crates/gateway-api/src/admin/mod.rs

@@ -58,6 +58,7 @@ async fn admin_not_found() -> AdminError {
 async fn no_store(mut response: Response) -> Response {
     response
         .headers_mut()
-        .insert(header::CACHE_CONTROL, HeaderValue::from_static("no-store"));
+        .entry(header::CACHE_CONTROL)
+        .or_insert(HeaderValue::from_static("no-store"));
     response
 }

backend/crates/gateway-api/src/admin/observability/presenter.rs

@@ -531,24 +531,45 @@ pub(crate) fn ops_error_view(error: domain::OpsError) -> OpsErrorView {
         .or(error.provider_account_name.as_ref())
         .or(error.provider_account_ref.as_ref())
         .cloned();
+    let model = error
+        .upstream_model_id
+        .clone()
+        .or_else(|| error.requested_model_id.clone());
     OpsErrorView {
         id: error.event_id,
         request_id: error.request_id,
         client_api_key_id: error.client_api_key_ref,
         kind: error.component.clone(),
+        operation: error.operation,
+        protocol: error.protocol,
+        client_transport: error.client_transport,
         provider: error.provider_kind,
         authentication_kind: error.provider_account_authentication_kind,
         account_id: error.provider_account_ref,
+        account_name: error.provider_account_name,
+        account_email: error.provider_account_email,
         route: error.endpoint.unwrap_or_else(|| "—".to_owned()),
-        model: error.upstream_model_id,
+        model,
+        requested_model: error.requested_model_id,
+        upstream_model: error.upstream_model_id,
+        service_tier: error.service_tier,
         client_status_code: error.client_status_code.map(i64::from),
         upstream_status_code: error.upstream_status_code.map(i64::from),
         transport: error.upstream_transport,
         attempt_index: error.attempt_index,
         failure_class: error.failure_kind,
+        provider_error_code: error.provider_error_code,
+        occurrence_count: error.occurrence_count,
         response_id: error.client_response_id,
         upstream_request_id: error.upstream_request_id,
         latency_ms: error.latency_ms,
+        client_ip: error.client_ip,
+        user_agent: error.user_agent,
+        reasoning_effort: error.reasoning_effort,
+        reasoning_preset: error.reasoning_preset,
+        request_kind: error.request_kind,
+        subagent_kind: error.subagent_kind,
+        compact: error.compact,
         message: error.message,
         metadata: OpsErrorMetadataView {
             source: error.source,

backend/crates/gateway-api/src/admin/observability/query.rs

@@ -351,7 +351,8 @@ pub(crate) fn ops_command(query: &OpsQuery) -> Result<domain::OpsErrorQuery, Wir
             request_id: non_empty(query.request_id.clone()),
             provider_kind: non_empty(query.provider.clone()),
             provider_account_ref: non_empty(query.account_id.clone()),
-            operation: non_empty(query.route.clone()).or_else(|| non_empty(query.kind.clone())),
+            operation: non_empty(query.kind.clone()),
+            endpoint: non_empty(query.route.clone()),
             model: non_empty(query.model.clone()),
             transport: non_empty(query.transport.clone()),
             attempt_index: parse_attempt_index(query.attempt_index)?,

backend/crates/gateway-api/src/admin/observability/wire.rs

@@ -758,19 +758,36 @@ pub struct OpsErrorView {
     pub request_id: Option<String>,
     pub client_api_key_id: Option<String>,
     pub kind: String,
+    pub operation: String,
+    pub protocol: Option<String>,
+    pub client_transport: Option<String>,
     pub provider: Option<String>,
     pub authentication_kind: Option<String>,
     pub account_id: Option<String>,
+    pub account_name: Option<String>,
+    pub account_email: Option<String>,
     pub route: String,
     pub model: Option<String>,
+    pub requested_model: Option<String>,
+    pub upstream_model: Option<String>,
+    pub service_tier: Option<String>,
     pub client_status_code: Option<i64>,
     pub upstream_status_code: Option<i64>,
     pub transport: Option<String>,
     pub attempt_index: Option<u32>,
     pub failure_class: String,
+    pub provider_error_code: Option<String>,
+    pub occurrence_count: u32,
     pub response_id: Option<String>,
     pub upstream_request_id: Option<String>,
     pub latency_ms: Option<u64>,
+    pub client_ip: Option<String>,
+    pub user_agent: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_preset: Option<String>,
+    pub request_kind: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub compact: Option<bool>,
     pub message: String,
     pub metadata: OpsErrorMetadataView,
     pub created_at: DateTime<Utc>,

backend/crates/gateway-api/src/openai/responses/request.rs

@@ -455,10 +455,11 @@ fn passthrough_header_name(name: &str, connection_headers: &[String]) -> bool {
             | "x-openai-project"
             // installation ID 始终由当前 lease 重建。
             | "x-codex-installation-id"
-            // 上游指纹必须由运行时画像统一生成，客户端 originator/User-Agent
-            // 不能透传覆盖，避免不同下游客户端暴露不一致的设备指纹。
+            // 上游指纹必须由运行时画像统一生成，客户端 originator/User-Agent/version
+            // 不能作为不透明头透传覆盖，避免不同下游客户端暴露不一致的设备指纹。
             | "originator"
             | "user-agent"
+            | "version"
             // 设备 attestation/integrity 头只能由官方客户端或网关自身生成，
             // 客户端注入的 x-oai-attestation / X-OAI-IS 不得透传上游。
             | "x-oai-attestation"

backend/crates/gateway-api/tests/admin/accounts.rs

@@ -76,7 +76,7 @@ mod profile_statistics {
         ProviderProfileActivityInsights, ProviderProfileDailyUsage, ProviderProfileInvocation,
         ProviderProfileStatistics, ProviderProfileStatisticsSummary,
     };
-    use gateway_api::admin::accounts::AccountProfileStatisticsData;
+    use gateway_api::admin::accounts::{AccountProfileAvatarQuery, AccountProfileStatisticsData};
     use serde_json::json;
 
     #[test]
@@ -134,6 +134,74 @@ mod profile_statistics {
         assert!(value.get("models").is_none());
         assert!(value.get("estimatedCost").is_none());
     }
+
+    #[test]
+    fn profile_avatar_query_accepts_only_bounded_cache_versions() {
+        let valid: AccountProfileAvatarQuery = serde_json::from_value(json!({
+            "accountId": "acct_openai",
+            "version": "k9m2z1"
+        }))
+        .expect("decode avatar query");
+        valid.validate().expect("validate avatar query");
+
+        for version in ["", "contains-dash", "x23456789012345678901234567890123"] {
+            let query: AccountProfileAvatarQuery = serde_json::from_value(json!({
+                "accountId": "acct_openai",
+                "version": version
+            }))
+            .expect("decode invalid avatar query");
+            assert_eq!(
+                query.validate().expect_err("reject version").field(),
+                "version"
+            );
+        }
+        assert!(
+            serde_json::from_value::<AccountProfileAvatarQuery>(json!({
+                "accountId": "acct_openai",
+                "sourceUrl": "https://example.test/avatar"
+            }))
+            .is_err()
+        );
+    }
+}
+
+mod profile_avatar {
+    use axum::body::to_bytes;
+    use bytes::Bytes;
+    use futures::stream;
+    use gateway_admin::model::provider_credentials::ProviderProfileAvatar;
+    use gateway_api::admin::accounts::profile_avatar_response;
+
+    #[tokio::test]
+    async fn profile_avatar_response_preserves_stream_metadata_and_private_cache() {
+        let response = profile_avatar_response(ProviderProfileAvatar {
+            content_type: Some("image/svg+xml".to_owned()),
+            content_length: Some(6),
+            etag: Some("\"v1\"".to_owned()),
+            body: Box::pin(stream::iter([Ok(Bytes::from_static(b"avatar"))])),
+        });
+
+        assert_eq!(response.status(), 200);
+        assert_eq!(response.headers()["content-type"], "image/svg+xml");
+        assert_eq!(response.headers()["content-length"], "6");
+        assert_eq!(response.headers()["etag"], "\"v1\"");
+        assert_eq!(response.headers()["cache-control"], "private, max-age=3600");
+        assert_eq!(response.headers()["x-content-type-options"], "nosniff");
+        assert_eq!(
+            response.headers()["cross-origin-resource-policy"],
+            "same-origin"
+        );
+        assert_eq!(
+            response.headers()["content-security-policy"],
+            "sandbox; default-src 'none'"
+        );
+        assert_eq!(
+            to_bytes(response.into_body(), 16)
+                .await
+                .expect("avatar response body"),
+            Bytes::from_static(b"avatar")
+        );
+    }
 }
 
 mod batch_update {

backend/crates/gateway-api/tests/admin/observability/response.rs

@@ -539,6 +539,10 @@ async fn ops_errors_should_keep_account_label_and_authentication_contract() {
             client_api_key_ref: Some("key_err".to_owned()),
             component: "model_request".to_owned(),
             operation: "responses".to_owned(),
+            protocol: Some("openai".to_owned()),
+            client_transport: Some("http_sse".to_owned()),
+            requested_model_id: Some("gpt-5.4".to_owned()),
+            service_tier: Some("priority".to_owned()),
             endpoint: Some("/v1/responses".to_owned()),
             provider_kind: Some("openai".to_owned()),
             provider_account_ref: Some("acct_err".to_owned()),
@@ -556,6 +560,13 @@ async fn ops_errors_should_keep_account_label_and_authentication_contract() {
             latency_ms: Some(90),
             message: "snapshot error".to_owned(),
             occurrence_count: 1,
+            client_ip: Some("203.0.113.8".to_owned()),
+            user_agent: Some("codex-cli/0.144.0".to_owned()),
+            reasoning_effort: Some("medium".to_owned()),
+            reasoning_preset: None,
+            request_kind: Some("root".to_owned()),
+            subagent_kind: None,
+            compact: Some(false),
             occurred_at: Utc::now(),
             stable_sort_id: "model_request:req_err".to_owned(),
         });
@@ -585,6 +596,11 @@ async fn ops_errors_should_keep_account_label_and_authentication_contract() {
             "accountLabel": value["data"]["items"][0]["metadata"]["accountLabel"],
             "clientStatusCode": value["data"]["items"][0]["clientStatusCode"],
             "route": value["data"]["items"][0]["route"],
+            "requestedModel": value["data"]["items"][0]["requestedModel"],
+            "clientTransport": value["data"]["items"][0]["clientTransport"],
+            "clientIp": value["data"]["items"][0]["clientIp"],
+            "userAgent": value["data"]["items"][0]["userAgent"],
+            "providerErrorCode": value["data"]["items"][0]["providerErrorCode"],
         }),
         serde_json::json!({
             "provider": "openai",
@@ -594,6 +610,11 @@ async fn ops_errors_should_keep_account_label_and_authentication_contract() {
             "accountLabel": "err@example.invalid",
             "clientStatusCode": 502,
             "route": "/v1/responses",
+            "requestedModel": "gpt-5.4",
+            "clientTransport": "http_sse",
+            "clientIp": "203.0.113.8",
+            "userAgent": "codex-cli/0.144.0",
+            "providerErrorCode": "upstream",
         })
     );
 }

backend/crates/gateway-api/tests/openai/responses/mod.rs

@@ -320,8 +320,8 @@ fn decoder_should_preserve_ordinary_request_headers_as_opaque_multivalues() {
         vec![b"future-ascii".to_vec(), b"\x80\xff".to_vec()]
     );
     assert_eq!(
-        values("version"),
-        vec![b"future-v1".to_vec(), b"future-\x80".to_vec()]
+        openai_protocol_context(&decoded).get("version"),
+        Some(&json!("future-v1"))
     );
     assert_eq!(
         values("openai-beta"),
@@ -349,6 +349,7 @@ fn decoder_should_preserve_ordinary_request_headers_as_opaque_multivalues() {
         // 上游指纹由运行时画像统一生成，客户端不得覆盖。
         "user-agent",
         "originator",
+        "version",
         "x-oai-attestation",
         "x-oai-is",
         "x-oai-is-update",

backend/crates/gateway-core/src/engine/coordinator.rs

@@ -12,11 +12,11 @@ use crate::engine::continuation::{
 };
 use crate::engine::provider::{Provider, ProviderCallMetadata, ProviderRequest, ProviderStream};
 use crate::engine::{
-    AccountAttemptContext, AttemptContext, AttemptRecord, AttemptTrigger, CancellationToken,
-    CommitRequirement, ContinuationAttempt, CoordinatedEvent, EngineError, ExecutionOutcome,
-    ExecutionStore, GatewayEngine, IntermediateFailure, ModelRequestFinalization, ModelRequestId,
-    ModelRequestTimings, NewModelRequest, ProviderAccountStateOwner, ProviderAttemptOutcome,
-    RequestAttemptContext, UpstreamSendState,
+    AccountAttemptContext, AttemptContext, AttemptRecord, AttemptTransport, AttemptTrigger,
+    CancellationToken, CommitRequirement, ContinuationAttempt, CoordinatedEvent, EngineError,
+    ExecutionOutcome, ExecutionStore, GatewayEngine, IntermediateFailure, ModelRequestFinalization,
+    ModelRequestId, ModelRequestTimings, NewModelRequest, ProviderAccountStateOwner,
+    ProviderAttemptOutcome, RequestAttemptContext, UpstreamSendState,
 };
 use crate::error::{GatewayError, GatewayErrorKind, ProviderError, ProviderErrorKind, StoreError};
 use crate::event::{
@@ -166,6 +166,7 @@ where
             excluded_accounts: BTreeSet::new(),
             credential_recovery_attempted_accounts: BTreeSet::new(),
             recovery_account: None,
+            transport_fallback_account: None,
             current: None,
             send_state_watermark: UpstreamSendState::NotSent,
             downstream_committed_at: None,
@@ -245,6 +246,9 @@ pub struct ResponseExecutionSession<S: ?Sized> {
     /// attempt 建立时即被消费，后续可重试错误仍可换号消耗剩余重试预算。
     /// 与 `required_account`（外部指定、贯穿整个请求）语义不同，不可合并。
     recovery_account: Option<crate::engine::credential::ProviderAccountId>,
+    /// 上游传输在提交边界前失败后的一次性同账号备用传输钉选。
+    /// 与凭据恢复分开保存，避免把 transport fallback 误记为 OAuth 恢复。
+    transport_fallback_account: Option<crate::engine::credential::ProviderAccountId>,
     current: Option<CurrentAttempt>,
     /// 请求级发送状态水位；跨 attempt 单调不降，终态写回不得低于此档。
     send_state_watermark: UpstreamSendState,
@@ -610,14 +614,26 @@ where
             .checked_add(1)
             .and_then(NonZeroU32::new)
             .ok_or(EngineError::EmptyRoutingPlan)?;
-        // recovery 钉选在此被一次性消费，只绑定本次 replay attempt；
+        // 请求局部恢复钉选在此被一次性消费，只绑定本次 replay attempt；
         // 外部 required_account 每次 attempt 都重新生效。
-        let pinned_account = match &self.account_selection {
-            AccountSelection::Diagnostic(account) => Some(account.clone()),
-            AccountSelection::Scheduled(_) => self
-                .recovery_account
-                .take()
-                .or_else(|| self.account_selection.required_account().cloned()),
+        let (pinned_account, attempt_transport) = match &self.account_selection {
+            AccountSelection::Diagnostic(account) => {
+                (Some(account.clone()), AttemptTransport::Default)
+            }
+            AccountSelection::Scheduled(_) => {
+                let transport_fallback_account = self.transport_fallback_account.take();
+                let transport = if transport_fallback_account.is_some() {
+                    AttemptTransport::Fallback
+                } else {
+                    AttemptTransport::Default
+                };
+                (
+                    transport_fallback_account
+                        .or_else(|| self.recovery_account.take())
+                        .or_else(|| self.account_selection.required_account().cloned()),
+                    transport,
+                )
+            }
         };
         let account_context = match &self.account_selection {
             AccountSelection::Diagnostic(account) => AccountAttemptContext::diagnostic(
@@ -646,7 +662,8 @@ where
             self.continuation.clone(),
             self.cancellation.clone(),
         )
-        .with_continuation_attempt(self.continuation_attempt);
+        .with_continuation_attempt(self.continuation_attempt)
+        .with_transport(attempt_transport);
         let trigger = if self.attempts == 0 {
             AttemptTrigger::Initial
         } else {
@@ -1023,6 +1040,11 @@ where
             && !self.delivery_pending
             && error.allows_pre_delivery_retry()
             && self.attempts < self.plan.max_attempts().get();
+        let transport_fallback_retry = pre_delivery_retry
+            && matches!(
+                error.pre_delivery_retry(),
+                Some(crate::error::PreDeliveryRetry::SameAccountTransportFallback)
+            );
         let ordinary_retry = self.account_selection.required_account().is_none()
             && self.continuation_attempt == ContinuationAttempt::None
             && self.downstream_committed_at.is_none()
@@ -1053,6 +1075,9 @@ where
                 // 只钉住紧随其后的 replay attempt；replay 再遇可重试错误时，
                 // ordinary/continuation 重试门不受影响，仍可换号。
                 self.recovery_account = Some(account);
+            } else if transport_fallback_retry {
+                self.transport_fallback_account =
+                    Some(current.metadata.provider_account_id().clone());
             } else if !continuation_retry {
                 self.excluded_accounts
                     .insert(current.metadata.provider_account_id().clone());

backend/crates/gateway-core/src/engine/mod.rs

@@ -106,6 +106,16 @@ pub enum AttemptTrigger {
     AccountRetry,
 }
 
+/// Provider 可为当前 attempt 选择的请求局部传输档位。
+#[derive(Debug, Clone, Copy, Default, PartialEq, Eq, Hash)]
+pub enum AttemptTransport {
+    /// 使用 Provider 的默认传输策略。
+    #[default]
+    Default,
+    /// 使用 Provider 定义的备用传输。
+    Fallback,
+}
+
 impl AttemptTrigger {
     #[must_use]
     pub const fn as_str(self) -> &'static str {
@@ -224,8 +234,8 @@ fn lock_unpoisoned<T>(mutex: &Mutex<T>) -> std::sync::MutexGuard<'_, T> {
 
 /// 单次 attempt 的账号选择与账号绑定状态事实。
 ///
-/// `required_account` 只用于管理端 connection test 等必须命中唯一账号的内部请求；
-/// 一旦设置，Core 与 Provider 都不得换号或切换 target。
+/// `required_account` 用于管理端 connection test，或请求局部的同账号恢复 attempt；
+/// 一旦设置，Provider 在本 attempt 内不得换号或切换 target。
 #[derive(Debug, Clone, Default)]
 pub struct AccountAttemptContext {
     excluded_accounts: BTreeSet<ProviderAccountId>,
@@ -425,6 +435,7 @@ pub struct AttemptContext {
     account: AccountAttemptContext,
     continuation: Option<ContinuationBinding>,
     continuation_attempt: ContinuationAttempt,
+    transport: AttemptTransport,
     cancellation: CancellationToken,
 }
 
@@ -452,6 +463,7 @@ impl AttemptContext {
             account,
             continuation,
             continuation_attempt,
+            transport: AttemptTransport::Default,
             cancellation,
         }
     }
@@ -466,6 +478,13 @@ impl AttemptContext {
         self
     }
 
+    /// 覆盖本次 attempt 的 Provider 传输档位。
+    #[must_use]
+    pub const fn with_transport(mut self, transport: AttemptTransport) -> Self {
+        self.transport = transport;
+        self
+    }
+
     #[must_use]
     pub const fn request_id(&self) -> &ModelRequestId {
         self.request.request_id()
@@ -503,7 +522,7 @@ impl AttemptContext {
         self.account.excluded_accounts()
     }
 
-    /// 管理端 connection test 等内部请求强制使用的唯一账号。
+    /// 管理端诊断或请求局部恢复 attempt 强制使用的唯一账号。
     #[must_use]
     pub const fn required_account(&self) -> Option<&ProviderAccountId> {
         self.account.required_account()
@@ -542,6 +561,12 @@ impl AttemptContext {
         self.continuation_attempt
     }
 
+    /// 返回本次 attempt 的 Provider 传输档位。
+    #[must_use]
+    pub const fn transport(&self) -> AttemptTransport {
+        self.transport
+    }
+
     #[must_use]
     pub const fn cancellation(&self) -> &CancellationToken {
         &self.cancellation

backend/crates/gateway-core/src/error.rs

@@ -197,6 +197,15 @@ pub enum ContinuationFailure {
     HistoryUnavailable,
 }
 
+/// Provider 在下游尚未提交事件时请求的隐藏恢复方式。
+#[derive(Debug, Clone, Copy, PartialEq, Eq, Hash)]
+pub enum PreDeliveryRetry {
+    /// 排除本次账号，按普通调度策略重新选号。
+    AccountRotation,
+    /// 固定本次账号，并要求 Provider 使用备用传输。
+    SameAccountTransportFallback,
+}
+
 /// Adapter 已明确分类为非 bearer 的不透明上游值。
 ///
 /// Core 不解释或校验内容，只通过自定义 [`Debug`] 避免它意外进入日志。协议 adapter
@@ -360,7 +369,7 @@ pub struct ProviderError {
     retry_after: Option<Duration>,
     continuation_failure: Option<ContinuationFailure>,
     replay_safe: bool,
-    pre_delivery_retry: bool,
+    pre_delivery_retry: Option<PreDeliveryRetry>,
     credential_recovery_required: bool,
     retry_same_account: bool,
     sensitive_context_redacted: bool,
@@ -390,7 +399,7 @@ impl ProviderError {
             retry_after: None,
             continuation_failure: None,
             replay_safe: false,
-            pre_delivery_retry: false,
+            pre_delivery_retry: None,
             credential_recovery_required: false,
             retry_same_account: false,
             sensitive_context_redacted: false,
@@ -456,7 +465,17 @@ impl ProviderError {
     /// 指定账号或下游已经进入提交状态时必须忽略它。
     #[must_use]
     pub const fn with_pre_delivery_retry(mut self) -> Self {
-        self.pre_delivery_retry = true;
+        self.pre_delivery_retry = Some(PreDeliveryRetry::AccountRotation);
+        self
+    }
+
+    /// 允许 Core 在首个客户端事件前固定原账号并改用 Provider 备用传输。
+    ///
+    /// 与普通换号恢复相同，Core 仍会拒绝 continuation、指定账号、预算耗尽或
+    /// 下游已提交后的隐藏重放。
+    #[must_use]
+    pub const fn with_pre_delivery_transport_fallback(mut self) -> Self {
+        self.pre_delivery_retry = Some(PreDeliveryRetry::SameAccountTransportFallback);
         self
     }
 
@@ -561,9 +580,15 @@ impl ProviderError {
         self.replay_safe
     }
 
-    /// 返回 Provider 是否允许在首个客户端事件前换号恢复传输失败。
+    /// 返回 Provider 是否允许在首个客户端事件前隐藏恢复传输失败。
     #[must_use]
     pub const fn allows_pre_delivery_retry(&self) -> bool {
+        self.pre_delivery_retry.is_some()
+    }
+
+    /// 返回下游提交前由 Provider 选择的隐藏恢复方式。
+    #[must_use]
+    pub const fn pre_delivery_retry(&self) -> Option<PreDeliveryRetry> {
         self.pre_delivery_retry
     }
 

backend/crates/gateway-core/tests/engine/coordinator.rs

@@ -23,9 +23,9 @@ use gateway_core::engine::provider::{
     ProviderRegistry, ProviderRequest, ProviderStream, UpstreamTransport,
 };
 use gateway_core::engine::{
-    AttemptContext, AttemptCoordinator, AttemptRecord, CancellationToken, CommitRequirement,
-    ContinuationAttempt, EngineError, ExecutionOutcome, ExecutionStore, GatewayEngine,
-    IntermediateFailure, ModelRequestFinalization, ModelRequestId, NewModelRequest,
+    AttemptContext, AttemptCoordinator, AttemptRecord, AttemptTransport, CancellationToken,
+    CommitRequirement, ContinuationAttempt, EngineError, ExecutionOutcome, ExecutionStore,
+    GatewayEngine, IntermediateFailure, ModelRequestFinalization, ModelRequestId, NewModelRequest,
     ProviderAttemptOutcome, RecoveryReport, UpstreamSendState,
 };
 use gateway_core::error::{
@@ -2754,6 +2754,49 @@ fn pre_delivery_transport_failure_rotates_account_for_non_idempotent_generation(
     assert_eq!(state.finalizations[0].outcome, ExecutionOutcome::Succeeded);
 }
 
+#[test]
+fn pre_delivery_transport_fallback_retries_the_same_account_with_fallback_transport() {
+    let operation = generate_operation();
+    let route_plan = plan(&operation);
+    let (coordinator, store, provider) = coordinator(vec![
+        Script::Stream {
+            account_id: "acct_first",
+            items: vec![Err(ProviderError::new(
+                ProviderErrorKind::Transport,
+                UpstreamSendState::Ambiguous,
+            )
+            .with_pre_delivery_transport_fallback())],
+        },
+        Script::Stream {
+            account_id: "acct_first",
+            items: complete_stream(None),
+        },
+    ]);
+
+    let mut session = block_on(coordinator.start(
+        model_request(&operation, SystemTime::now() + Duration::from_secs(30)),
+        operation,
+        route_plan,
+        None,
+        None,
+        CancellationToken::new(),
+    ))
+    .expect("start execution");
+    block_on(session.collect_uncommitted()).expect("same-account fallback succeeds");
+    block_on(session.commit_downstream(Some(200))).expect("commit winning response");
+
+    let original = ProviderAccountId::new("acct_first").expect("account id");
+    let contexts = provider.contexts.lock().expect("contexts lock");
+    assert_eq!(contexts.len(), 2);
+    assert_eq!(contexts[0].transport(), AttemptTransport::Default);
+    assert_eq!(contexts[1].transport(), AttemptTransport::Fallback);
+    assert_eq!(contexts[1].required_account(), Some(&original));
+    assert!(!contexts[1].excluded_accounts().contains(&original));
+    let state = store.state.lock().expect("store lock");
+    assert_eq!(state.intermediate_failures, 1);
+    assert_eq!(state.finalizations[0].outcome, ExecutionOutcome::Succeeded);
+}
+
 #[test]
 fn final_capacity_exhaustion_returns_the_last_retryable_upstream_failure() {
     let operation = generate_operation();
@@ -2890,7 +2933,7 @@ fn pre_delivery_retry_marker_is_ignored_after_downstream_commit() {
                 ))),
                 Err(
                     ProviderError::new(ProviderErrorKind::Transport, UpstreamSendState::Ambiguous)
-                        .with_pre_delivery_retry(),
+                        .with_pre_delivery_transport_fallback(),
                 ),
             ],
         },

backend/crates/gateway-store/src/postgres/observability/mapping.rs

@@ -51,6 +51,7 @@ pub(crate) fn store_ops_error_filter(
         provider_account_ref: filter.provider_account_ref,
         provider_kind: filter.provider_kind,
         operation: filter.operation,
+        endpoint: filter.endpoint,
         model: filter.model,
         transport: filter.transport,
         attempt_index: filter.attempt_index,
@@ -700,6 +701,10 @@ pub(crate) fn admin_ops_error(error: OpsErrorRecord) -> admin_observability::Ops
         client_api_key_ref: error.client_api_key_ref,
         component: error.component,
         operation: error.operation,
+        protocol: error.protocol,
+        client_transport: error.client_transport,
+        requested_model_id: error.requested_model_id,
+        service_tier: error.service_tier,
         endpoint: error.endpoint,
         provider_kind: error.provider_kind,
         provider_account_ref: error.provider_account_ref,
@@ -717,6 +722,13 @@ pub(crate) fn admin_ops_error(error: OpsErrorRecord) -> admin_observability::Ops
         latency_ms: error.latency_ms,
         message: error.message,
         occurrence_count: error.occurrence_count,
+        client_ip: error.client_ip,
+        user_agent: error.user_agent,
+        reasoning_effort: error.reasoning_effort,
+        reasoning_preset: error.reasoning_preset,
+        request_kind: error.request_kind,
+        subagent_kind: error.subagent_kind,
+        compact: error.compact,
         occurred_at: error.occurred_at,
         stable_sort_id: error.stable_sort_id,
     }
@@ -866,6 +878,10 @@ pub(crate) fn ops_error_from_row(row: &sqlx::postgres::PgRow) -> StoreResult<Ops
         client_api_key_ref: get(row, "client_api_key_ref")?,
         component: get(row, "component")?,
         operation: get(row, "operation")?,
+        protocol: get(row, "protocol")?,
+        client_transport: get(row, "client_transport")?,
+        requested_model_id: get(row, "requested_model_id")?,
+        service_tier: get(row, "service_tier")?,
         endpoint: get(row, "endpoint")?,
         provider_kind: get(row, "provider_kind")?,
         provider_account_ref: get(row, "provider_account_ref")?,
@@ -883,6 +899,13 @@ pub(crate) fn ops_error_from_row(row: &sqlx::postgres::PgRow) -> StoreResult<Ops
         latency_ms: optional_unsigned(row, "latency_ms")?,
         message: get(row, "message")?,
         occurrence_count: to_u32(get(row, "occurrence_count")?)?,
+        client_ip: get(row, "client_ip")?,
+        user_agent: get(row, "user_agent")?,
+        reasoning_effort: get(row, "reasoning_effort")?,
+        reasoning_preset: get(row, "reasoning_preset")?,
+        request_kind: get(row, "request_kind")?,
+        subagent_kind: get(row, "subagent_kind")?,
+        compact: get(row, "compact")?,
         occurred_at: get(row, "occurred_at")?,
         stable_sort_id: get(row, "stable_sort_id")?,
     })

backend/crates/gateway-store/src/postgres/observability/model.rs

@@ -126,6 +126,7 @@ pub struct OpsErrorFilter {
     pub provider_account_ref: Option<String>,
     pub provider_kind: Option<String>,
     pub operation: Option<String>,
+    pub endpoint: Option<String>,
     pub model: Option<String>,
     pub transport: Option<String>,
     pub attempt_index: Option<u32>,
@@ -147,6 +148,7 @@ impl OpsErrorFilter {
             ),
             (self.provider_kind.as_deref(), "provider filter"),
             (self.operation.as_deref(), "operation filter"),
+            (self.endpoint.as_deref(), "endpoint filter"),
             (self.model.as_deref(), "model filter"),
             (self.transport.as_deref(), "transport filter"),
             (
@@ -694,6 +696,10 @@ pub struct OpsErrorRecord {
     pub client_api_key_ref: Option<String>,
     pub component: String,
     pub operation: String,
+    pub protocol: Option<String>,
+    pub client_transport: Option<String>,
+    pub requested_model_id: Option<String>,
+    pub service_tier: Option<String>,
     pub endpoint: Option<String>,
     pub provider_kind: Option<String>,
     pub provider_account_ref: Option<String>,
@@ -711,6 +717,13 @@ pub struct OpsErrorRecord {
     pub latency_ms: Option<u64>,
     pub message: String,
     pub occurrence_count: u32,
+    pub client_ip: Option<String>,
+    pub user_agent: Option<String>,
+    pub reasoning_effort: Option<String>,
+    pub reasoning_preset: Option<String>,
+    pub request_kind: Option<String>,
+    pub subagent_kind: Option<String>,
+    pub compact: Option<bool>,
     pub occurred_at: DateTime<Utc>,
     pub stable_sort_id: String,
 }

backend/crates/gateway-store/src/postgres/observability/queries/ops.rs

@@ -6,6 +6,7 @@ const REQUEST_ERROR_SELECT: &str = "select 'model_request'::text as source,
        mr.id as event_id, mr.id as request_id,
        nullif(mr.attempt_count, 0) as attempt_index,
        mr.client_api_key_ref, 'model_request'::text as component, mr.operation,
+       mr.protocol, mr.client_transport, mr.requested_model_id, mr.service_tier,
        mr.endpoint, mr.provider_kind, mr.provider_account_ref,
        mr.provider_account_name_snapshot as provider_account_name,
        mr.provider_account_email_snapshot as provider_account_email,
@@ -17,7 +18,11 @@ const REQUEST_ERROR_SELECT: &str = "select 'model_request'::text as source,
        mr.provider_error_code, mr.client_response_id, mr.upstream_request_id,
        mr.latency_ms,
        coalesce(mr.error_message, mr.error_kind, 'request failed') as message,
-       1::integer as occurrence_count, mr.completed_at as occurred_at,
+       1::integer as occurrence_count,
+       host(mr.client_ip) as client_ip, mr.user_agent,
+       mr.reasoning_effort, mr.reasoning_preset, mr.request_kind,
+       mr.subagent_kind, mr.compact,
+       mr.completed_at as occurred_at,
        'model_request:' || mr.id as stable_sort_id
 from model_requests mr
 where mr.outcome = 'failed'";
@@ -25,7 +30,8 @@ where mr.outcome = 'failed'";
 const OPS_EVENT_SELECT: &str = "select 'ops_event'::text as source,
        oe.id as event_id, oe.model_request_id as request_id, oe.attempt_index,
        mr.client_api_key_ref, oe.component, oe.operation,
-       null::text as endpoint, oe.provider_kind, oe.provider_account_ref,
+       mr.protocol, mr.client_transport, mr.requested_model_id, mr.service_tier,
+       mr.endpoint, oe.provider_kind, oe.provider_account_ref,
        oe.provider_account_name_snapshot as provider_account_name,
        oe.provider_account_email_snapshot as provider_account_email,
        oe.provider_account_authentication_kind_snapshot
@@ -33,7 +39,11 @@ const OPS_EVENT_SELECT: &str = "select 'ops_event'::text as source,
        oe.upstream_model_id, null::text as upstream_transport, oe.failure_kind,
        null::integer as client_status_code, oe.status_code as upstream_status_code,
        oe.provider_error_code, mr.client_response_id, oe.upstream_request_id,
-       oe.latency_ms, oe.message, oe.occurrence_count, oe.created_at as occurred_at,
+       oe.latency_ms, oe.message, oe.occurrence_count,
+       host(mr.client_ip) as client_ip, mr.user_agent,
+       mr.reasoning_effort, mr.reasoning_preset, mr.request_kind,
+       mr.subagent_kind, mr.compact,
+       oe.created_at as occurred_at,
        'ops_event:' || oe.id as stable_sort_id
 from ops_events oe
 left join model_requests mr on mr.id = oe.model_request_id
@@ -107,6 +117,7 @@ fn push_request_error_predicates(
         ("mr.provider_account_ref", &filter.provider_account_ref),
         ("mr.provider_kind", &filter.provider_kind),
         ("mr.operation", &filter.operation),
+        ("mr.endpoint", &filter.endpoint),
         ("mr.upstream_transport", &filter.transport),
         ("mr.upstream_request_id", &filter.upstream_request_id),
     ] {
@@ -153,6 +164,7 @@ fn push_ops_event_predicates(
         ("oe.provider_account_ref", &filter.provider_account_ref),
         ("oe.provider_kind", &filter.provider_kind),
         ("oe.operation", &filter.operation),
+        ("mr.endpoint", &filter.endpoint),
         ("oe.upstream_request_id", &filter.upstream_request_id),
         ("oe.failure_kind", &filter.failure_kind),
     ] {

backend/crates/gateway-store/src/postgres/observability/queries/usage.rs

@@ -117,7 +117,7 @@ pub(crate) const USAGE_LIST_RECORD_SELECT: &str =
             mr.first_event_ms, mr.first_reasoning_ms, mr.first_text_ms, mr.first_token_ms,
             mr.provider_processing_ms, mr.latency_ms, mr.admission_decision_ms,
             mr.account_selection_wait_ms, mr.capacity_used_slots, mr.capacity_total_slots,
-            mr.client_ip::text as client_ip, mr.user_agent,
+            host(mr.client_ip) as client_ip, mr.user_agent,
             mr.reasoning_effort, mr.reasoning_preset, mr.subagent_kind, mr.compact,
             mr.started_at
      from model_requests mr";
@@ -145,7 +145,7 @@ pub(crate) const USAGE_RECORD_DETAIL_SELECT: &str =
             mr.first_event_ms, mr.first_reasoning_ms, mr.first_text_ms, mr.first_token_ms,
             mr.provider_processing_ms, mr.latency_ms, mr.admission_decision_ms,
             mr.account_selection_wait_ms, mr.capacity_used_slots, mr.capacity_total_slots,
-            mr.client_ip::text as client_ip,
+            host(mr.client_ip) as client_ip,
             mr.user_agent, mr.reasoning_effort, mr.reasoning_preset, mr.request_kind,
             mr.subagent_kind, mr.compact, mr.image_generation_requested,
             mr.image_generation_succeeded, mr.started_at, mr.deadline_at, mr.completed_at

backend/crates/gateway-store/tests/postgres/observability.rs

@@ -761,6 +761,8 @@ async fn admin_observability_adapter_preserves_utc_queries_metrics_costs_and_det
                 request_id: Some("req_observe_failed".to_owned()),
                 provider_kind: Some("openai".to_owned()),
                 provider_account_ref: Some("acct_observe".to_owned()),
+                operation: Some("responses".to_owned()),
+                endpoint: Some("/v1/responses".to_owned()),
                 model: Some("upstream-model".to_owned()),
                 failure_kind: Some("rate_limited".to_owned()),
                 status_code: Some(429),
@@ -1191,6 +1193,15 @@ async fn observability_queries_preserve_request_account_cost_and_diagnostic_fact
         .expect("request error");
     assert_eq!(request_error.client_status_code, Some(502));
     assert_eq!(request_error.upstream_status_code, Some(429));
+    assert_eq!(request_error.client_ip.as_deref(), Some("203.0.113.9"));
+    assert_eq!(
+        request_error.user_agent.as_deref(),
+        Some("codex-cli/0.144.0")
+    );
+    assert_eq!(
+        request_error.requested_model_id.as_deref(),
+        Some("public-model")
+    );
     let attempt_error = errors
         .items
         .iter()
@@ -1198,6 +1209,12 @@ async fn observability_queries_preserve_request_account_cost_and_diagnostic_fact
         .expect("attempt error");
     assert_eq!(attempt_error.client_status_code, None);
     assert_eq!(attempt_error.upstream_status_code, Some(429));
+    assert_eq!(attempt_error.endpoint.as_deref(), Some("/v1/responses"));
+    assert_eq!(attempt_error.client_ip.as_deref(), Some("203.0.113.9"));
+    assert_eq!(
+        attempt_error.user_agent.as_deref(),
+        Some("codex-cli/0.144.0")
+    );
 
     database.close().await;
 }
@@ -1286,7 +1303,7 @@ async fn seed_observability_facts(
     sqlx::query(
         "insert into model_requests (
            id, client_api_key_ref, config_revision, protocol, operation, endpoint,
-           client_transport, requested_model_id,
+           client_transport, requested_model_id, service_tier,
            provider_kind, provider_account_id,
            provider_account_ref, upstream_model_id, upstream_transport, attempt_count,
            provider_account_name_snapshot, provider_account_email_snapshot,
@@ -1295,16 +1312,20 @@ async fn seed_observability_facts(
            error_kind, provider_error_code, error_message, retry_after_ms,
            input_tokens, cached_tokens, image_generation_requested,
            image_generation_succeeded, cost_source, latency_ms,
+           client_ip, user_agent, reasoning_effort, reasoning_preset,
+           request_kind, subagent_kind, compact,
            started_at, deadline_at, completed_at,
            routing_scope, routing_group_refs, routing_group_names_snapshot
          ) values (
            'req_observe_failed', 'key_observe', 1, 'openai', 'responses', '/v1/responses',
-           'http_sse', 'public-model', 'openai', 'acct_observe',
+           'http_sse', 'public-model', 'priority', 'openai', 'acct_observe',
            'acct_observe', 'upstream-model',
            'http_sse', 2,
            'primary', 'account@example.invalid', 'oauth',
            'sent', 'failed', 502, 429, 'rate_limited', 'rate_limit',
            'upstream limited', 1000, 0, 0, true, false, 'unavailable', 700,
+           '203.0.113.9', 'codex-cli/0.144.0', 'medium', null,
+           'root', null, false,
            $1 - interval '10 minutes', $1 + interval '20 minutes', $1 - interval '9 minutes',
            'all', '{}'::text[], '[]'::jsonb
          )",

backend/crates/providers/openai/src/admin.rs

@@ -5,6 +5,7 @@ use std::time::SystemTime;
 
 use async_trait::async_trait;
 use chrono::{DateTime, Utc};
+use futures::TryStreamExt as _;
 use gateway_admin::model::accounts::AccountRecord;
 use gateway_admin::model::observability::{
     CalculatedBillingBreakdown, CurrencyCost, DashboardDesktopRelease, DashboardWireAttribute,
@@ -19,9 +20,10 @@ use gateway_admin::model::provider_credentials::{
     PreparedCredentialCreate, PreparedCredentialImport, PreparedCredentialRotation,
     PreparedCredentialRotationFacts, ProviderDocument, ProviderExport,
     ProviderExportCredentialInput, ProviderModel, ProviderModels, ProviderProfileActivityInsights,
-    ProviderProfileDailyUsage, ProviderProfileInvocation, ProviderProfileStatistics,
-    ProviderProfileStatisticsSummary, ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow,
-    ProviderQuotaWindowRole, ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
+    ProviderProfileAvatar, ProviderProfileAvatarStreamError, ProviderProfileDailyUsage,
+    ProviderProfileInvocation, ProviderProfileStatistics, ProviderProfileStatisticsSummary,
+    ProviderQuota, ProviderQuotaRequest, ProviderQuotaWindow, ProviderQuotaWindowRole,
+    ProviderResetCredit, ProviderResetCreditResult, ProviderResetCredits,
     QuotaLocalUsageAttribution,
 };
 use gateway_admin::model::{MutationActor, MutationContext, Revision};
@@ -49,10 +51,10 @@ use crate::credential::{
     CodexCredentialAdminService, CodexCredentialCatalogError, CodexCredentialCatalogService,
     CodexCredentialProfileService, CodexCredentialQuotaError, CodexCredentialQuotaService,
     CodexOAuthAdmin, CodexOAuthAdminError, CodexOAuthPendingClaimOutcome, CodexOAuthPendingStore,
-    CodexOAuthPendingStoreError, CodexPendingAuthorization, CodexProfileStatisticsError,
-    CodexQuotaWindow, CodexQuotaWindowKind, CodexQuotaWindowRole, CodexResetCreditsError,
-    CompleteCodexOAuthAuthorization, CompletedCodexOAuthCredential, ExportManagedCodexCredential,
-    StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
+    CodexOAuthPendingStoreError, CodexPendingAuthorization, CodexProfileAvatarError,
+    CodexProfileStatisticsError, CodexQuotaWindow, CodexQuotaWindowKind, CodexQuotaWindowRole,
+    CodexResetCreditsError, CompleteCodexOAuthAuthorization, CompletedCodexOAuthCredential,
+    ExportManagedCodexCredential, StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
 use crate::credential::{
     CodexCredentialCodec, CodexOAuthSecret, oauth_owner_ref, parse_access_token_expiration,
@@ -61,7 +63,9 @@ use crate::transport::CodexWebSocketPool;
 use crate::transport::profile::{
     CodexDesktopReleaseSnapshot, CodexDesktopReleaseStatus, CodexWireProfile, CodexWireProfileState,
 };
-use crate::transport::{CodexProfileStatistics, OpenAiBillingUsage, openai_billing_breakdown};
+use crate::transport::{
+    CodexProfileAvatar, CodexProfileStatistics, OpenAiBillingUsage, openai_billing_breakdown,
+};
 
 const PROVIDER_NAME: &str = "openai";
 const PENDING_DOCUMENT_SCHEMA_VERSION: u64 = 3;
@@ -462,6 +466,18 @@ impl ProviderAdmin for OpenAiAdminProvider {
         Ok(project_profile_statistics(statistics))
     }
 
+    async fn profile_avatar(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<ProviderProfileAvatar, ProviderAdminError> {
+        self.account(account_id).await?;
+        self.profile_statistics
+            .profile_avatar(account_id)
+            .await
+            .map(project_profile_avatar)
+            .map_err(map_profile_avatar_error)
+    }
+
     async fn reset_credits(
         &self,
         account_id: &ProviderAccountId,
@@ -865,6 +881,15 @@ fn project_profile_statistics(statistics: CodexProfileStatistics) -> ProviderPro
     }
 }
 
+fn project_profile_avatar(avatar: CodexProfileAvatar) -> ProviderProfileAvatar {
+    ProviderProfileAvatar {
+        content_type: avatar.content_type,
+        content_length: avatar.content_length,
+        etag: avatar.etag,
+        body: Box::pin(avatar.body.map_err(|_| ProviderProfileAvatarStreamError)),
+    }
+}
+
 fn project_reset_credits(
     credits: crate::transport::CodexRateLimitResetCredits,
 ) -> ProviderResetCredits {
@@ -1498,6 +1523,19 @@ fn map_profile_statistics_error(error: CodexProfileStatisticsError) -> ProviderA
     }
 }
 
+fn map_profile_avatar_error(error: CodexProfileAvatarError) -> ProviderAdminError {
+    match error {
+        CodexProfileAvatarError::ProfileStatistics(error) => map_profile_statistics_error(error),
+        CodexProfileAvatarError::Missing => provider_admin_error(ProviderAdminErrorKind::NotFound),
+        CodexProfileAvatarError::InvalidSource | CodexProfileAvatarError::Upstream { .. } => {
+            provider_admin_error(ProviderAdminErrorKind::BadGateway)
+        }
+        CodexProfileAvatarError::TransportUnavailable => {
+            provider_admin_error(ProviderAdminErrorKind::Unavailable)
+        }
+    }
+}
+
 fn map_reset_credits_error(error: CodexResetCreditsError) -> ProviderAdminError {
     use CodexResetCreditsError as Error;
 

backend/crates/providers/openai/src/credential/mod.rs

@@ -38,7 +38,9 @@ pub use oauth::{
     CodexPendingAuthorization, CompleteCodexOAuthAuthorization, CompletedCodexOAuthAuthorization,
     CompletedCodexOAuthCredential, StartCodexOAuthAuthorization, StoredCodexPendingAuthorization,
 };
-pub use profile_statistics::{CodexCredentialProfileService, CodexProfileStatisticsError};
+pub use profile_statistics::{
+    CodexCredentialProfileService, CodexProfileAvatarError, CodexProfileStatisticsError,
+};
 pub use quota::{
     CodexAccountQuotaSnapshot, CodexCredentialQuotaError, CodexCredentialQuotaService,
     CodexQuotaFact, CodexQuotaRefreshPolicy, CodexQuotaSyncSummary, CodexQuotaWindow,

backend/crates/providers/openai/src/credential/profile_statistics.rs

@@ -1,6 +1,10 @@
-//! OpenAI 当前账号个人资料统计查询编排。
+//! OpenAI 当前账号个人资料统计与官方头像查询编排。
 
-use std::time::SystemTime;
+use std::{
+    collections::HashMap,
+    sync::Mutex,
+    time::{Duration, Instant, SystemTime},
+};
 
 use gateway_core::engine::credential::ProviderAccountId;
 use reqwest::Client;
@@ -10,11 +14,14 @@ use uuid::Uuid;
 
 use crate::transport::profile::CodexWireProfileState;
 use crate::transport::{
-    CodexBackendClient, CodexClientError, CodexProfileStatistics, CodexRequestContext,
+    CodexBackendClient, CodexClientError, CodexProfileAvatar, CodexProfileAvatarFetchError,
+    CodexProfileStatistics, CodexRequestContext, fetch_profile_avatar,
 };
 
 use super::CodexCredentialRepository;
 
+const PROFILE_AVATAR_SOURCE_TTL: Duration = Duration::from_secs(10 * 60);
+
 #[derive(Error)]
 pub enum CodexProfileStatisticsError {
     #[error("Codex profile-statistics credential data is invalid")]
@@ -59,16 +66,55 @@ impl std::fmt::Debug for CodexProfileStatisticsError {
     }
 }
 
+#[derive(Error)]
+pub enum CodexProfileAvatarError {
+    #[error(transparent)]
+    ProfileStatistics(#[from] CodexProfileStatisticsError),
+    #[error("Codex profile does not provide an avatar")]
+    Missing,
+    #[error("Codex profile avatar source is invalid")]
+    InvalidSource,
+    #[error("Codex profile avatar upstream returned HTTP {status}")]
+    Upstream { status: u16 },
+    #[error("Codex profile avatar transport is unavailable")]
+    TransportUnavailable,
+}
+
+impl std::fmt::Debug for CodexProfileAvatarError {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        match self {
+            Self::ProfileStatistics(error) => formatter
+                .debug_tuple("ProfileStatistics")
+                .field(error)
+                .finish(),
+            Self::Missing => formatter.write_str("Missing"),
+            Self::InvalidSource => formatter.write_str("InvalidSource"),
+            Self::Upstream { status } => formatter
+                .debug_struct("Upstream")
+                .field("status", status)
+                .finish(),
+            Self::TransportUnavailable => formatter.write_str("TransportUnavailable"),
+        }
+    }
+}
+
+#[derive(Clone)]
+struct CachedProfileAvatarSource {
+    source: String,
+    expires_at: Instant,
+}
+
 pub struct CodexCredentialProfileService {
     repository: CodexCredentialRepository,
     profile: CodexWireProfileState,
     http: Client,
     base_url: String,
+    avatar_sources: Mutex<HashMap<ProviderAccountId, CachedProfileAvatarSource>>,
 }
 
 impl CodexCredentialProfileService {
     #[must_use]
-    pub const fn new(
+    pub fn new(
         repository: CodexCredentialRepository,
         profile: CodexWireProfileState,
         http: Client,
@@ -79,6 +125,7 @@ impl CodexCredentialProfileService {
             profile,
             http,
             base_url,
+            avatar_sources: Mutex::new(HashMap::new()),
         }
     }
 
@@ -114,7 +161,7 @@ impl CodexCredentialProfileService {
             .authorization_header()
             .map_err(|_| CodexProfileStatisticsError::InvalidCredentialData)?;
         let request_id = format!("profile_statistics_{}", Uuid::now_v7().simple());
-        CodexBackendClient::new(
+        let statistics = CodexBackendClient::new(
             self.http.clone(),
             self.base_url.clone(),
             self.profile.clone(),
@@ -126,7 +173,72 @@ impl CodexCredentialProfileService {
             None,
         ))
         .await
-        .map_err(map_client_error)
+        .map_err(map_client_error)?;
+        self.remember_avatar_source(account_id, statistics.image_url.as_deref());
+        Ok(statistics)
+    }
+
+    pub async fn profile_avatar(
+        &self,
+        account_id: &ProviderAccountId,
+    ) -> Result<CodexProfileAvatar, CodexProfileAvatarError> {
+        let source = match self.cached_avatar_source(account_id) {
+            Some(source) => source,
+            None => self
+                .profile_statistics(account_id)
+                .await?
+                .image_url
+                .ok_or(CodexProfileAvatarError::Missing)?,
+        };
+        let desktop_user_agent = self.profile.snapshot().desktop_user_agent();
+        fetch_profile_avatar(&self.http, &self.base_url, &desktop_user_agent, &source)
+            .await
+            .map_err(map_avatar_fetch_error)
+    }
+
+    fn cached_avatar_source(&self, account_id: &ProviderAccountId) -> Option<String> {
+        let now = Instant::now();
+        let mut sources = self
+            .avatar_sources
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        sources.retain(|_, source| source.expires_at > now);
+        sources.get(account_id).map(|source| source.source.clone())
+    }
+
+    fn remember_avatar_source(&self, account_id: &ProviderAccountId, source: Option<&str>) {
+        let now = Instant::now();
+        let mut sources = self
+            .avatar_sources
+            .lock()
+            .unwrap_or_else(std::sync::PoisonError::into_inner);
+        sources.retain(|_, source| source.expires_at > now);
+        match source {
+            Some(source) => {
+                sources.insert(
+                    account_id.clone(),
+                    CachedProfileAvatarSource {
+                        source: source.to_owned(),
+                        expires_at: now + PROFILE_AVATAR_SOURCE_TTL,
+                    },
+                );
+            }
+            None => {
+                sources.remove(account_id);
+            }
+        }
+    }
+}
+
+fn map_avatar_fetch_error(error: CodexProfileAvatarFetchError) -> CodexProfileAvatarError {
+    match error {
+        CodexProfileAvatarFetchError::InvalidSource => CodexProfileAvatarError::InvalidSource,
+        CodexProfileAvatarFetchError::Upstream { status } => {
+            CodexProfileAvatarError::Upstream { status }
+        }
+        CodexProfileAvatarFetchError::TransportUnavailable => {
+            CodexProfileAvatarError::TransportUnavailable
+        }
     }
 }
 

backend/crates/providers/openai/src/provider.rs

@@ -16,7 +16,7 @@ use gateway_core::engine::provider::{
     ProviderSelectionObservation, ProviderStream, UpstreamTransport,
 };
 use gateway_core::engine::{
-    AttemptContext, CancellationToken, ContinuationAttempt, UpstreamSendState,
+    AttemptContext, AttemptTransport, CancellationToken, ContinuationAttempt, UpstreamSendState,
 };
 use gateway_core::error::{
     ClientVisibleUpstreamError, ClientVisibleUpstreamResponse, ContinuationFailure,
@@ -47,6 +47,7 @@ use secrecy::{ExposeSecret, SecretString};
 use serde::{Deserialize, Serialize};
 use serde_json::{Map, Value, json};
 use url::Url;
+use uuid::Uuid;
 
 use crate::credential::{
     CodexAccountFailure, CodexCredentialCatalogError, CodexCredentialCatalogService,
@@ -70,7 +71,7 @@ use crate::transport::profile::{
 };
 use crate::transport::protocol::responses::{
     CodexResponsesRequest, PREVIOUS_RESPONSE_NOT_FOUND_CODE, PREVIOUS_RESPONSE_NOT_FOUND_MESSAGE,
-    PreviousResponseScope, ResponseEventSignals,
+    PreviousResponseScope, ResponseEventSignals, transport_requirement,
 };
 use crate::transport::request::{
     CodexRequestEncodeError, RequestAccountScope, encode_generate_request, scope_request_to_account,
@@ -287,7 +288,10 @@ impl Provider for CodexProvider {
             derive_codex_session_affinity(&upstream_request, context.client_api_key_ref());
         let cyber_policy_session_key =
             derive_codex_cyber_policy_session_key(&upstream_request, context.client_api_key_ref());
-        let transport = selected_transport(&upstream_request);
+        let transport = match context.transport() {
+            AttemptTransport::Default => selected_transport(&upstream_request),
+            AttemptTransport::Fallback => CodexProviderTransport::HttpOnly,
+        };
         apply_transport(&mut upstream_request, transport);
 
         let selection_started_at = Instant::now();
@@ -751,6 +755,12 @@ fn cold_json_response_stream(request: ColdJsonResponse) -> EventStream {
             account_selection,
         )
         .await;
+        if let Err(CodexHandshakeAttemptError::Client(error)) = &response {
+            log_client_upstream_error(
+                UpstreamErrorLogContext::new(&request.context, &active_account, None),
+                error,
+            );
+        }
         let response = match response.map_err(map_handshake_attempt_error) {
             Ok(response) => response,
             Err(mut failure) => {
@@ -877,6 +887,12 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
             &cancellation,
         )
         .await;
+        if let Err(CodexHandshakeAttemptError::Client(error)) = &response {
+            log_client_upstream_error(
+                UpstreamErrorLogContext::new(&context, &active_account, None),
+                error,
+            );
+        }
         let response = response.map_err(map_handshake_attempt_error);
         let response = match response {
             Ok(response) => response,
@@ -944,6 +960,8 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
         {
             active_account = current;
         }
+        let response_transport = response.transport;
+        let websocket_connection_id = response.websocket_connection_id;
         let mut body = response.body;
         let failure_diagnostics = response.diagnostics.clone();
         let failure_set_cookie_headers = response.set_cookie_headers.clone();
@@ -988,7 +1006,17 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
                 _ = wait_for_replay_grace(replay_grace_deadline) => Ok(PreCommitPoll::GraceElapsed),
                 chunk = body.next() => match chunk {
                     Some(Ok(chunk)) => Ok(PreCommitPoll::Upstream(Some(chunk))),
-                    Some(Err(error)) => Err(map_stream_error(error)),
+                    Some(Err(error)) => {
+                        log_client_upstream_error(
+                            UpstreamErrorLogContext::new(
+                                &context,
+                                &active_account,
+                                websocket_connection_id,
+                            ),
+                            &error,
+                        );
+                        Err(map_stream_error(error))
+                    }
                     None => Ok(PreCommitPoll::Upstream(None)),
                 },
             };
@@ -1000,7 +1028,14 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
                     }
                     continue;
                 }
-                Err(failure) => {
+                Err(mut failure) => {
+                    if failure.error.allows_pre_delivery_retry()
+                        && response_transport == CodexBackendTransport::WebSocket
+                        && transport_requirement(&request).allows_pre_delivery_http_fallback()
+                        && !pre_commit_events.is_committed()
+                    {
+                        failure.error = failure.error.with_pre_delivery_transport_fallback();
+                    }
                     let updates = take_rate_limit_updates(rate_limit_updates.as_ref()).await;
                     if !updates.is_empty() {
                         passive_quota_observation.observe(&updates);
@@ -1057,6 +1092,15 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
             let service_tier_changed = observation_state
                 .observe_upstream_service_tier(decoder.response_service_tier());
             let terminal_failure = canonical_failure.map(|(error, semantic_output_seen)| {
+                log_canonical_upstream_error(
+                    UpstreamErrorLogContext::new(
+                        &context,
+                        &active_account,
+                        websocket_connection_id,
+                    ),
+                    response_transport,
+                    &error,
+                );
                 let atomic_upstream_failure = matches!(&error, CodexCanonicalError::Upstream(_));
                 (
                     map_canonical_error(
@@ -1148,6 +1192,15 @@ fn cold_response_stream(response: ColdResponse) -> EventStream {
             }
         };
         let terminal_failure = canonical_failure.map(|(error, semantic_output_seen)| {
+            log_canonical_upstream_error(
+                UpstreamErrorLogContext::new(
+                    &context,
+                    &active_account,
+                    websocket_connection_id,
+                ),
+                response_transport,
+                &error,
+            );
             let atomic_upstream_failure = matches!(&error, CodexCanonicalError::Upstream(_));
             (
                 map_canonical_error(
@@ -2194,6 +2247,141 @@ struct OpenAiFailureContext<'a> {
     allows_account_state_mutation: bool,
 }
 
+#[derive(Clone, Copy)]
+struct UpstreamErrorLogContext<'a> {
+    request_id: &'a str,
+    account_id: &'a str,
+    attempt_index: u32,
+    websocket_connection_id: Option<Uuid>,
+}
+
+impl<'a> UpstreamErrorLogContext<'a> {
+    fn new(
+        context: &'a AttemptContext,
+        account: &'a ProviderAccount,
+        websocket_connection_id: Option<Uuid>,
+    ) -> Self {
+        Self {
+            request_id: context.request_id().as_str(),
+            account_id: account.id().as_str(),
+            attempt_index: context.attempt_index().get(),
+            websocket_connection_id,
+        }
+    }
+
+    fn with_websocket_connection_id(mut self, connection_id: Option<Uuid>) -> Self {
+        self.websocket_connection_id = self.websocket_connection_id.or(connection_id);
+        self
+    }
+}
+
+fn log_client_upstream_error(context: UpstreamErrorLogContext<'_>, error: &CodexClientError) {
+    match error {
+        CodexClientError::Upstream {
+            status,
+            body,
+            transport,
+            ..
+        } => log_raw_upstream_body(
+            context,
+            *transport,
+            "http_error_response",
+            Some(status.as_u16()),
+            None,
+            None,
+            body,
+        ),
+        CodexClientError::WebSocket(CodexWebSocketExchangeError::Upstream(upstream)) => {
+            log_raw_upstream_body(
+                context,
+                CodexBackendTransport::WebSocket,
+                "websocket_opening_response",
+                Some(upstream.status_code),
+                None,
+                None,
+                &upstream.body,
+            );
+        }
+        CodexClientError::WebSocket(error) => {
+            let Some(close) = error.close_before_terminal() else {
+                return;
+            };
+            let context = context.with_websocket_connection_id(close.connection_id());
+            let websocket_connection_id = context
+                .websocket_connection_id
+                .map(|connection_id| connection_id.to_string())
+                .unwrap_or_default();
+            let upstream_error_raw = close.reason().unwrap_or_default();
+            tracing::warn!(
+                request_id = %context.request_id,
+                account_id = %context.account_id,
+                attempt_index = context.attempt_index,
+                websocket_connection_id,
+                upstream_transport = WEBSOCKET_TRANSPORT,
+                upstream_error_kind = "websocket_close",
+                upstream_close_code = close.code().unwrap_or_default(),
+                upstream_close_code_present = close.code().is_some(),
+                upstream_error_raw,
+                upstream_error_raw_bytes = upstream_error_raw.len(),
+                upstream_error_raw_present = close.reason().is_some(),
+                "OpenAI upstream WebSocket closed before terminal event"
+            );
+        }
+        _ => {}
+    }
+}
+
+fn log_canonical_upstream_error(
+    context: UpstreamErrorLogContext<'_>,
+    transport: CodexBackendTransport,
+    error: &CodexCanonicalError,
+) {
+    let CodexCanonicalError::Upstream(failure) = error else {
+        return;
+    };
+    log_raw_upstream_body(
+        context,
+        transport,
+        "responses_error_event",
+        failure.explicit_status_code,
+        failure.upstream_code.as_deref(),
+        failure.upstream_type.as_deref(),
+        failure.raw_body(),
+    );
+}
+
+fn log_raw_upstream_body(
+    context: UpstreamErrorLogContext<'_>,
+    transport: CodexBackendTransport,
+    error_kind: &'static str,
+    status_code: Option<u16>,
+    upstream_code: Option<&str>,
+    upstream_type: Option<&str>,
+    upstream_error_raw: &str,
+) {
+    let websocket_connection_id = context
+        .websocket_connection_id
+        .map(|connection_id| connection_id.to_string())
+        .unwrap_or_default();
+    tracing::warn!(
+        request_id = %context.request_id,
+        account_id = %context.account_id,
+        attempt_index = context.attempt_index,
+        websocket_connection_id,
+        upstream_transport = actual_transport_name(transport),
+        upstream_error_kind = error_kind,
+        upstream_status_code = status_code.unwrap_or_default(),
+        upstream_status_code_present = status_code.is_some(),
+        upstream_error_code = upstream_code.unwrap_or_default(),
+        upstream_error_code_present = upstream_code.is_some(),
+        upstream_error_type = upstream_type.unwrap_or_default(),
+        upstream_error_type_present = upstream_type.is_some(),
+        upstream_error_raw,
+        upstream_error_raw_bytes = upstream_error_raw.len(),
+        "OpenAI upstream returned an error payload"
+    );
+}
+
 async fn apply_failure(
     context: &OpenAiFailureContext<'_>,
     account: &ProviderAccount,
@@ -2415,11 +2603,20 @@ fn map_client_error(
             ))
         }
         CodexClientError::WebSocket(error) => {
+            let close_code = error.close_before_terminal().and_then(|close| close.code());
             let client_visible_error = websocket_client_visible_error(&error);
             let mut failure = MappedProviderFailure::plain(provider_error(
                 websocket_error_kind(&error),
                 websocket_send_state(&error),
             ));
+            if let Some(close_code) = close_code {
+                failure.error =
+                    failure
+                        .error
+                        .with_upstream_code(OpaqueUpstreamValue::new(format!(
+                            "websocket_close_{close_code}"
+                        )));
+            }
             if let Some(client_visible_error) = client_visible_error {
                 failure.error = failure
                     .error

backend/crates/providers/openai/src/transport/canonical.rs

@@ -59,7 +59,7 @@ pub enum CodexCanonicalError {
     Protocol(#[source] ProviderError),
     /// 上游在成功建立流后发送了明确的失败事件。
     #[error("Codex upstream reported a failed response")]
-    Upstream(ResponsesSseFailure),
+    Upstream(Box<ResponsesSseFailure>),
 }
 
 impl fmt::Debug for CodexCanonicalError {
@@ -291,7 +291,11 @@ impl CodexCanonicalDecoder {
         let signals = response_event_signals(event_type, &value);
         self.merge_timing_signals(signals);
         if matches!(event_type, Some("response.failed" | "error")) {
-            let failure = ResponsesSseFailure::from_event(event_type.unwrap_or_default(), &value);
+            let failure = ResponsesSseFailure::from_raw_event(
+                event_type.unwrap_or_default(),
+                &event.data,
+                &value,
+            );
             let mut canonical = Vec::new();
             if !self.started {
                 // 失败首帧可能是唯一携带 response_id 的上游事实。身份投影只做
@@ -307,7 +311,7 @@ impl CodexCanonicalDecoder {
             } else {
                 output.extend(canonical.into_iter().map(ProviderEvent::canonical));
             }
-            return Err(CodexCanonicalError::Upstream(failure));
+            return Err(CodexCanonicalError::Upstream(Box::new(failure)));
         }
         let mut canonical = Vec::new();
         if let Some(event_type) = event_type {

backend/crates/providers/openai/src/transport/client.rs

@@ -22,6 +22,7 @@ use reqwest::{
 };
 use serde_json::{Value, map::Map};
 use thiserror::Error;
+use uuid::Uuid;
 
 use crate::transport::protocol::responses::{CodexResponsesRequest, TransportRequirement};
 
@@ -401,7 +402,7 @@ pub struct CodexRequestContext<'a> {
     pub beta_features: Option<&'a str>,
     /// x-responsesapi-include-timing-metrics 头值。
     pub include_timing_metrics: Option<&'a str>,
-    /// 客户端版本号。
+    /// 下游 `version` 扩展头；存在时上游值由 Desktop 版本画像统一生成。
     pub version: Option<&'a str>,
     /// 客户端 window ID。
     pub codex_window_id: Option<&'a str>,
@@ -538,6 +539,8 @@ pub struct CodexBackendStreamingResponse {
     pub body: CodexBackendSseStream,
     /// 实际使用的上游传输。
     pub transport: CodexBackendTransport,
+    /// WebSocket 响应所绑定的连接；HTTP transport 为 `None`。
+    pub websocket_connection_id: Option<Uuid>,
     /// 响应头里的最新 turn state。
     pub turn_state: Option<String>,
     /// 上游透传的 `set-cookie` 列表。

backend/crates/providers/openai/src/transport/client_sse.rs

@@ -151,6 +151,7 @@ impl CodexBackendClient {
         Ok(CodexBackendStreamingResponse {
             body: http_sse_stream(response, Arc::clone(&rate_limit_updates)),
             transport: CodexBackendTransport::HttpSse,
+            websocket_connection_id: None,
             turn_state,
             set_cookie_headers,
             rate_limit_headers,
@@ -387,7 +388,20 @@ impl CodexBackendClient {
                     loop {
                         match await_websocket_delivery_boundary(&mut exchange).await {
                             Ok(DeliveryBoundary::Ready) => break,
-                            Ok(DeliveryBoundary::ConnectionLimitReached { message }) => {
+                            Ok(DeliveryBoundary::ConnectionLimitReached {
+                                message,
+                                raw_frame,
+                            }) => {
+                                let upstream_error_raw = String::from_utf8_lossy(&raw_frame);
+                                tracing::warn!(
+                                    request_id = %context.request_id,
+                                    account_id = context.account_id.unwrap_or_default(),
+                                    websocket_connection_id = %exchange.websocket_connection_id,
+                                    upstream_transport = "websocket",
+                                    upstream_error_kind = "websocket_error_frame",
+                                    upstream_error_raw = %upstream_error_raw,
+                                    "OpenAI upstream returned a recoverable WebSocket error frame"
+                                );
                                 if fresh_retry_used {
                                     // 新连接仍被限流：与官方重试预算耗尽一致，降级同账号 HTTP/SSE。
                                     return self
@@ -513,6 +527,7 @@ impl CodexBackendClient {
                             .map_err(websocket_exchange_error_to_client_error),
                     ),
                     transport: CodexBackendTransport::WebSocket,
+                    websocket_connection_id: Some(exchange.websocket_connection_id),
                     turn_state: exchange.turn_state,
                     set_cookie_headers: exchange.set_cookie_headers,
                     rate_limit_headers: exchange.rate_limit_headers,
@@ -546,6 +561,7 @@ impl CodexBackendClient {
         delivery_wait_started_at: Instant,
         error: CodexWebSocketExchangeError,
     ) -> CodexClientResult<CodexBackendStreamingResponse> {
+        log_raw_websocket_close(context, &error);
         self.http_fallback_before_delivery(
             request,
             context,
@@ -672,15 +688,16 @@ impl CodexBackendClient {
             X_OPENAI_MEMGEN_REQUEST_HEADER,
             request.memgen_request.as_deref(),
         );
-        // 客户端确实携带的普通协议头优先；没有携带时才使用上面的 Codex profile 默认值。
+        // 客户端确实携带的普通协议头优先；画像身份头只能由 Codex profile 生成。
         for name in request.passthrough_headers.keys() {
-            // 上游指纹必须由运行时画像统一生成：originator/User-Agent 即使绕过
-            // API 透传黑名单也不能覆盖画像，避免下游客户端暴露不一致指纹。
+            // 上游指纹必须由运行时画像统一生成：originator/User-Agent/version 即使
+            // 绕过 API 透传黑名单也不能覆盖画像，避免下游客户端暴露不一致指纹。
             if matches!(
                 name.as_str(),
                 "openai-beta"
                     | "originator"
                     | "user-agent"
+                    | "version"
                     | "x-oai-attestation"
                     | "x-oai-is"
                     | "x-oai-is-update"
@@ -754,7 +771,17 @@ impl CodexBackendClient {
             "x-responsesapi-include-timing-metrics",
             context.include_timing_metrics,
         );
-        insert_optional_protocol_header(&mut headers, "version", context.version);
+        // 官方 Desktop 的版本画像来自 clientInfo.version。保留下游是否携带
+        // `version` 扩展头的协议形状，但上游值统一使用当前 Desktop 制品版本。
+        if context
+            .version
+            .is_some_and(|version| HeaderValue::from_str(version).is_ok())
+        {
+            headers.insert(
+                HeaderName::from_static("version"),
+                HeaderValue::from_str(&profile.desktop_version)?,
+            );
+        }
         insert_optional_protocol_header(
             &mut headers,
             "x-codex-parent-thread-id",
@@ -807,6 +834,8 @@ enum DeliveryBoundary {
     ConnectionLimitReached {
         /// 上游错误说明。
         message: String,
+        /// 从 WebSocket 文本事件构造的完整 SSE 错误帧。
+        raw_frame: bytes::Bytes,
     },
 }
 
@@ -819,26 +848,54 @@ async fn await_websocket_delivery_boundary(
             Some(Ok(frame)) if is_websocket_lifecycle_prelude(&frame) => prelude.push(frame),
             Some(Ok(frame)) => {
                 let limit_message = websocket_connection_limit_message(&frame);
+                let raw_frame = limit_message.as_ref().map(|_| frame.clone());
                 prelude.push(frame);
                 let remaining =
                     std::mem::replace(&mut exchange.body, Box::pin(futures::stream::empty()));
                 exchange.body =
                     Box::pin(futures::stream::iter(prelude.into_iter().map(Ok)).chain(remaining));
                 return Ok(match limit_message {
-                    Some(message) => DeliveryBoundary::ConnectionLimitReached { message },
+                    Some(message) => DeliveryBoundary::ConnectionLimitReached {
+                        message,
+                        raw_frame: raw_frame.unwrap_or_default(),
+                    },
                     None => DeliveryBoundary::Ready,
                 });
             }
             Some(Err(error)) => return Err(error),
             None => {
-                return Err(CodexWebSocketExchangeError::closed_before_terminal(
-                    None, None,
+                return Err(CodexWebSocketExchangeError::closed_before_terminal_on(
+                    exchange.websocket_connection_id,
+                    None,
+                    None,
                 ));
             }
         }
     }
 }
 
+fn log_raw_websocket_close(context: CodexRequestContext<'_>, error: &CodexWebSocketExchangeError) {
+    let Some(close) = error.close_before_terminal() else {
+        return;
+    };
+    let websocket_connection_id = close
+        .connection_id()
+        .map(|connection_id| connection_id.to_string())
+        .unwrap_or_default();
+    let upstream_error_raw = close.reason().unwrap_or_default();
+    tracing::warn!(
+        request_id = %context.request_id,
+        account_id = context.account_id.unwrap_or_default(),
+        websocket_connection_id,
+        upstream_transport = "websocket",
+        upstream_error_kind = "websocket_close",
+        upstream_close_code = ?close.code(),
+        upstream_error_raw,
+        upstream_error_raw_present = close.reason().is_some(),
+        "OpenAI upstream WebSocket closed before delivery"
+    );
+}
+
 fn is_websocket_lifecycle_prelude(frame: &[u8]) -> bool {
     frame.starts_with(b"event: response.created\n")
         || frame.starts_with(b"event: response.in_progress\n")

backend/crates/providers/openai/src/transport/mod.rs

@@ -9,6 +9,7 @@ pub mod diagnostics;
 pub mod endpoints;
 pub mod headers;
 pub mod profile;
+pub mod profile_avatar;
 pub mod profile_statistics;
 pub mod protocol;
 pub mod request;
@@ -41,6 +42,10 @@ pub use self::{
         WHAM_USAGE_PATH, endpoint_url, usage_endpoint_url,
     },
     headers::build_codex_base_headers,
+    profile_avatar::{
+        CodexProfileAvatar, CodexProfileAvatarFetchError, CodexProfileAvatarStreamError,
+        fetch_profile_avatar,
+    },
     profile_statistics::{
         CodexProfileActivityInsights, CodexProfileDailyUsage, CodexProfileInvocation,
         CodexProfileStatistics, CodexProfileStatisticsSummary,

backend/crates/providers/openai/src/transport/profile_avatar.rs

@@ -0,0 +1,141 @@
+//! Codex 官方个人资料头像的固定来源流式 transport。
+
+use std::{pin::Pin, time::Duration};
+
+use async_stream::try_stream;
+use bytes::Bytes;
+use futures::{Stream, StreamExt as _};
+use reqwest::{
+    Client, Url,
+    header::{ACCEPT, CONTENT_TYPE, ETAG, USER_AGENT},
+};
+use tokio::time::timeout;
+
+use super::endpoints::endpoint_url;
+
+const OFFICIAL_AVATAR_ORIGIN: &str = "https://chatgpt.com";
+const OFFICIAL_AVATAR_PATH_PREFIX: &str = "/backend-api/estuary/public_content/enc/";
+const PROVIDER_AVATAR_PATH_PREFIX: &str = "/estuary/public_content/enc/";
+const PROFILE_AVATAR_ACCEPT: &str =
+    "image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8";
+const PROFILE_AVATAR_HEADERS_TIMEOUT: Duration = Duration::from_secs(15);
+const PROFILE_AVATAR_STREAM_IDLE_TIMEOUT: Duration = Duration::from_secs(30);
+
+/// 头像正文流；不累积完整正文，也不设置总字节数上限。
+pub type CodexProfileAvatarStream =
+    Pin<Box<dyn Stream<Item = Result<Bytes, CodexProfileAvatarStreamError>> + Send + 'static>>;
+
+/// 响应开始后的头像流失败；不得携带带签名的上游 URL。
+#[derive(Debug, thiserror::Error)]
+#[error("Codex profile avatar stream failed")]
+pub struct CodexProfileAvatarStreamError;
+
+/// 已打开的官方头像响应；MIME 只透传，不做格式白名单判断。
+pub struct CodexProfileAvatar {
+    pub content_type: Option<String>,
+    pub content_length: Option<u64>,
+    pub etag: Option<String>,
+    pub body: CodexProfileAvatarStream,
+}
+
+impl std::fmt::Debug for CodexProfileAvatar {
+    fn fmt(&self, formatter: &mut std::fmt::Formatter<'_>) -> std::fmt::Result {
+        formatter
+            .debug_struct("CodexProfileAvatar")
+            .field("content_type", &self.content_type)
+            .field("content_length", &self.content_length)
+            .field("etag", &self.etag)
+            .field("body", &"<stream>")
+            .finish()
+    }
+}
+
+#[derive(Debug, thiserror::Error)]
+pub enum CodexProfileAvatarFetchError {
+    #[error("Codex profile avatar source is invalid")]
+    InvalidSource,
+    #[error("Codex profile avatar upstream returned HTTP {status}")]
+    Upstream { status: u16 },
+    #[error("Codex profile avatar transport is unavailable")]
+    TransportUnavailable,
+}
+
+/// 校验官方来源后，通过当前 Provider base URL 打开头像字节流。
+///
+/// # Errors
+///
+/// 来源不是固定的 ChatGPT Estuary 路径、请求失败或上游返回非成功状态时返回错误。
+pub async fn fetch_profile_avatar(
+    client: &Client,
+    base_url: &str,
+    desktop_user_agent: &str,
+    source: &str,
+) -> Result<CodexProfileAvatar, CodexProfileAvatarFetchError> {
+    let source_path = official_avatar_source_path(source)?;
+    let target = Url::parse(&endpoint_url(base_url, &source_path))
+        .map_err(|_| CodexProfileAvatarFetchError::TransportUnavailable)?;
+    let response = timeout(
+        PROFILE_AVATAR_HEADERS_TIMEOUT,
+        client
+            .get(target)
+            .header(ACCEPT, PROFILE_AVATAR_ACCEPT)
+            .header(USER_AGENT, desktop_user_agent)
+            .send(),
+    )
+    .await
+    .map_err(|_| CodexProfileAvatarFetchError::TransportUnavailable)?
+    .map_err(|_| CodexProfileAvatarFetchError::TransportUnavailable)?;
+    let status = response.status();
+    if !status.is_success() {
+        return Err(CodexProfileAvatarFetchError::Upstream {
+            status: status.as_u16(),
+        });
+    }
+
+    let content_type = response
+        .headers()
+        .get(CONTENT_TYPE)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_owned);
+    let etag = response
+        .headers()
+        .get(ETAG)
+        .and_then(|value| value.to_str().ok())
+        .map(str::to_owned);
+    let content_length = response.content_length();
+    let mut upstream = Box::pin(response.bytes_stream());
+    let body = try_stream! {
+        loop {
+            match timeout(PROFILE_AVATAR_STREAM_IDLE_TIMEOUT, upstream.next()).await {
+                Ok(Some(Ok(chunk))) => yield chunk,
+                Ok(Some(Err(_))) | Err(_) => Err(CodexProfileAvatarStreamError)?,
+                Ok(None) => break,
+            }
+        }
+    };
+
+    Ok(CodexProfileAvatar {
+        content_type,
+        content_length,
+        etag,
+        body: Box::pin(body),
+    })
+}
+
+fn official_avatar_source_path(source: &str) -> Result<String, CodexProfileAvatarFetchError> {
+    let source = Url::parse(source).map_err(|_| CodexProfileAvatarFetchError::InvalidSource)?;
+    if source.origin().ascii_serialization() != OFFICIAL_AVATAR_ORIGIN
+        || !source.username().is_empty()
+        || source.password().is_some()
+        || source.query().is_some()
+        || source.fragment().is_some()
+    {
+        return Err(CodexProfileAvatarFetchError::InvalidSource);
+    }
+    let opaque_path = source
+        .path()
+        .strip_prefix(OFFICIAL_AVATAR_PATH_PREFIX)
+        .filter(|path| !path.is_empty())
+        .ok_or(CodexProfileAvatarFetchError::InvalidSource)?;
+    Ok(format!("{PROVIDER_AVATAR_PATH_PREFIX}{opaque_path}"))
+}

backend/crates/providers/openai/src/transport/protocol/responses.rs

@@ -72,7 +72,7 @@ pub struct CodexResponsesRequest {
     pub turn_metadata: Option<String>,
     /// beta features 透传头。
     pub beta_features: Option<String>,
-    /// 客户端版本头。
+    /// 下游 `version` 扩展头；存在时上游值由 Desktop 版本画像统一生成。
     pub version: Option<String>,
     /// timing metrics 透传头。
     pub include_timing_metrics: Option<String>,
@@ -404,6 +404,8 @@ pub struct ResponsesSseFailure {
     pub explicit_status_code: Option<u16>,
     /// 上游显式重试间隔，或从官方限流消息中解析出的重试间隔。
     pub retry_after_seconds: Option<u64>,
+    /// 上游错误事件的原始 JSON data；只应在明确的失败审计边界读取。
+    raw_body: String,
 }
 
 impl fmt::Debug for ResponsesSseFailure {
@@ -422,6 +424,10 @@ impl fmt::Debug for ResponsesSseFailure {
 
 impl ResponsesSseFailure {
     pub fn from_event(event: &str, value: &Value) -> Self {
+        Self::from_raw_event(event, &value.to_string(), value)
+    }
+
+    pub(crate) fn from_raw_event(event: &str, raw_body: &str, value: &Value) -> Self {
         Self {
             event: event.to_string(),
             message: failure_message(value).unwrap_or_else(|| "Codex upstream SSE failed".into()),
@@ -429,8 +435,15 @@ impl ResponsesSseFailure {
             upstream_type: failure_type(value),
             explicit_status_code: failure_explicit_status_code(value),
             retry_after_seconds: events::retry_after_seconds_from_value(value),
+            raw_body: raw_body.to_owned(),
         }
     }
+
+    /// 返回上游错误事件未经重编码的 JSON data。
+    #[must_use]
+    pub fn raw_body(&self) -> &str {
+        &self.raw_body
+    }
 }
 
 fn failure_message(value: &Value) -> Option<String> {

backend/crates/providers/openai/src/transport/websocket/error.rs

@@ -4,6 +4,7 @@ use std::{fmt, time::Duration};
 
 use gateway_protocol::openai::sse::SseError;
 use thiserror::Error;
+use uuid::Uuid;
 
 use crate::transport::client::CodexClientVisibleUpstreamResponse;
 use crate::transport::diagnostics::CodexUpstreamDiagnostics;
@@ -104,13 +105,29 @@ pub enum CodexWebSocketExchangeError {
 /// close reason 只供原请求的客户端错误响应使用；`Debug` 与 `Display` 均不会输出它。
 #[derive(Clone, PartialEq, Eq)]
 pub struct CodexWebSocketCloseError {
+    connection_id: Option<Uuid>,
     code: Option<u16>,
     reason: Option<String>,
 }
 
 impl CodexWebSocketCloseError {
     pub(crate) fn new(code: Option<u16>, reason: Option<String>) -> Self {
-        Self { code, reason }
+        Self {
+            connection_id: None,
+            code,
+            reason,
+        }
+    }
+
+    pub(crate) fn with_connection_id(mut self, connection_id: Uuid) -> Self {
+        self.connection_id = Some(connection_id);
+        self
+    }
+
+    /// 返回承载该 close frame 的 WebSocket 连接标识。
+    #[must_use]
+    pub const fn connection_id(&self) -> Option<Uuid> {
+        self.connection_id
     }
 
     /// 返回上游 close code；没有 close frame 时为 `None`。
@@ -130,6 +147,7 @@ impl fmt::Debug for CodexWebSocketCloseError {
     fn fmt(&self, formatter: &mut fmt::Formatter<'_>) -> fmt::Result {
         formatter
             .debug_struct("CodexWebSocketCloseError")
+            .field("connection_id", &self.connection_id)
             .field("code", &self.code)
             .field("reason", &self.reason.as_ref().map(|_| "<redacted>"))
             .finish()
@@ -192,8 +210,14 @@ impl fmt::Display for CodexWebSocketUpstreamError {
 }
 
 impl CodexWebSocketExchangeError {
-    pub(crate) fn closed_before_terminal(code: Option<u16>, reason: Option<String>) -> Self {
-        Self::ClosedBeforeTerminal(CodexWebSocketCloseError::new(code, reason))
+    pub(crate) fn closed_before_terminal_on(
+        connection_id: Uuid,
+        code: Option<u16>,
+        reason: Option<String>,
+    ) -> Self {
+        Self::ClosedBeforeTerminal(
+            CodexWebSocketCloseError::new(code, reason).with_connection_id(connection_id),
+        )
     }
 
     pub(crate) fn close_before_terminal(&self) -> Option<&CodexWebSocketCloseError> {

backend/crates/providers/openai/src/transport/websocket/exchange/stream.rs

@@ -208,13 +208,15 @@ async fn forward_websocket_response_stream(state: WebSocketStreamForwardState) {
                 return;
             }
             tungstenite::Message::Close(frame) => {
+                let websocket_connection_id = websocket.connection_id();
                 discard_stream_websocket(
                     websocket,
                     pool_return,
                     StreamWebSocketDiscardReason::UpstreamClosed,
                 )
                 .await;
-                let error = CodexWebSocketExchangeError::closed_before_terminal(
+                let error = CodexWebSocketExchangeError::closed_before_terminal_on(
+                    websocket_connection_id,
                     frame.as_ref().map(|frame| u16::from(frame.code)),
                     frame.map(|frame| frame.reason.to_string()),
                 );
@@ -287,9 +289,11 @@ async fn forward_websocket_response_stream(state: WebSocketStreamForwardState) {
         }
     }
 
+    let websocket_connection_id = websocket.connection_id();
     let upstream_close = websocket
         .exit_reason()
-        .and_then(|reason| reason.upstream_close().cloned());
+        .and_then(|reason| reason.upstream_close().cloned())
+        .map(|close| close.with_connection_id(websocket_connection_id));
     discard_stream_websocket(
         websocket,
         pool_return,
@@ -297,7 +301,13 @@ async fn forward_websocket_response_stream(state: WebSocketStreamForwardState) {
     )
     .await;
     let error = upstream_close.map_or_else(
-        || CodexWebSocketExchangeError::closed_before_terminal(None, None),
+        || {
+            CodexWebSocketExchangeError::closed_before_terminal_on(
+                websocket_connection_id,
+                None,
+                None,
+            )
+        },
         CodexWebSocketExchangeError::ClosedBeforeTerminal,
     );
     let error = if reused_connection {

backend/crates/providers/openai/src/transport/websocket/pump.rs

@@ -556,12 +556,19 @@ fn log_pump_exit(
             "Responses WebSocket pump stopped unexpectedly"
         );
     } else if matches!(reason, PumpExitReason::UpstreamCloseFrame { .. }) {
+        let upstream_close = reason.upstream_close();
+        let upstream_error_raw = upstream_close
+            .and_then(CodexWebSocketCloseError::reason)
+            .unwrap_or_default();
         tracing::info!(
             websocket_connection_id = %connection_id,
             account_id = %account_id,
             conversation_id_hash = %conversation_id_hash,
             pump_exit_reason = reason.as_str(),
             pump_exit_detail = detail,
+            upstream_close_code = ?upstream_close.and_then(CodexWebSocketCloseError::code),
+            upstream_error_raw,
+            upstream_error_raw_present = upstream_close.is_some_and(|close| close.reason().is_some()),
             backpressure_events,
             "Responses WebSocket pump received close frame"
         );

backend/crates/providers/openai/tests/credential/profile_statistics.rs

@@ -1,6 +1,7 @@
 use std::sync::Arc;
 
 use chrono::{TimeZone as _, Utc};
+use futures::TryStreamExt as _;
 use gateway_core::engine::credential::ProviderAccountId;
 use provider_openai::credential::{CodexCredentialProfileService, ImportCodexOAuthCredential};
 use provider_openai::transport::profile::{CodexWireProfile, CodexWireProfileState};
@@ -155,3 +156,62 @@ async fn profile_statistics_keeps_profile_when_stats_are_unavailable() {
     assert_eq!(statistics.summary.total_text_tokens, None);
     assert_eq!(statistics.daily_usage, None);
 }
+
+#[tokio::test]
+async fn profile_avatar_reuses_cached_source_and_sends_no_account_credentials() {
+    let server = MockServer::start().await;
+    Mock::given(method("GET"))
+        .and(path("/wham/profiles/me"))
+        .respond_with(ResponseTemplate::new(200).set_body_json(json!({
+            "profile": {
+                "display_name": "Ada",
+                "profile_picture_url": "https://chatgpt.com/backend-api/estuary/public_content/enc/avatar-token="
+            },
+            "stats": {},
+            "metadata": {"stats_error": null}
+        })))
+        .expect(1)
+        .mount(&server)
+        .await;
+    Mock::given(method("GET"))
+        .and(path("/estuary/public_content/enc/avatar-token="))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "image/svg+xml")
+                .set_body_bytes(b"<svg xmlns=\"http://www.w3.org/2000/svg\"/>"),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+    let (store, service) = service("acct_profile_avatar", &server).await;
+    let account = store
+        .account("acct_profile_avatar")
+        .expect("profile account");
+
+    service
+        .profile_statistics(account.id())
+        .await
+        .expect("profile statistics");
+    let avatar = service
+        .profile_avatar(account.id())
+        .await
+        .expect("profile avatar");
+    let content_type = avatar.content_type.clone();
+    let chunks = avatar
+        .body
+        .try_collect::<Vec<_>>()
+        .await
+        .expect("avatar body");
+    let body = chunks.into_iter().flatten().collect::<Vec<_>>();
+    let requests = server.received_requests().await.expect("recorded requests");
+    let avatar_request = requests
+        .iter()
+        .find(|request| request.url.path() == "/estuary/public_content/enc/avatar-token=")
+        .expect("avatar request");
+
+    assert_eq!(content_type.as_deref(), Some("image/svg+xml"));
+    assert_eq!(body, b"<svg xmlns=\"http://www.w3.org/2000/svg\"/>");
+    assert!(!avatar_request.headers.contains_key("authorization"));
+    assert!(!avatar_request.headers.contains_key("cookie"));
+    assert!(!avatar_request.headers.contains_key("chatgpt-account-id"));
+}

backend/crates/providers/openai/tests/provider/contract.rs

@@ -18,10 +18,11 @@ use gateway_core::engine::credential::{
 };
 use gateway_core::engine::provider::{Provider as _, ProviderRequest};
 use gateway_core::engine::{
-    AccountAttemptContext, AttemptContext, CancellationToken, ContinuationAttempt, ModelRequestId,
-    ProviderAccountStateOwner, RequestAttemptContext, UpstreamSendState,
+    AccountAttemptContext, AttemptContext, AttemptTransport, CancellationToken,
+    ContinuationAttempt, ModelRequestId, ProviderAccountStateOwner, RequestAttemptContext,
+    UpstreamSendState,
 };
-use gateway_core::error::{ContinuationFailure, ProviderErrorKind};
+use gateway_core::error::{ContinuationFailure, PreDeliveryRetry, ProviderErrorKind};
 use gateway_core::event::GatewayEvent;
 use gateway_core::operation::{
     CapabilityRequirements, GenerateRequest, ImageRequest, ImageRequestKind, Operation,
@@ -445,6 +446,10 @@ fn context(request_id: &str, cancellation: CancellationToken) -> AttemptContext
     )
 }
 
+fn fallback_transport_context(request_id: &str) -> AttemptContext {
+    context(request_id, CancellationToken::new()).with_transport(AttemptTransport::Fallback)
+}
+
 fn diagnostic_context(request_id: &str, account_id: &str) -> AttemptContext {
     AttemptContext::new(
         RequestAttemptContext::new(
@@ -1194,6 +1199,125 @@ async fn websocket_close_details_are_only_exposed_through_the_client_error() {
     assert_eq!(detail.message(), "message too big");
     assert_eq!(detail.code(), Some("1009"));
     assert_eq!(detail.error_type(), Some("websocket_close_error"));
+    assert_eq!(
+        error.upstream_code().map(|code| code.as_str()),
+        Some("websocket_close_1009")
+    );
+}
+
+#[tokio::test]
+async fn websocket_normal_close_before_semantic_output_requests_same_account_http_fallback() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_websocket_close").await;
+    let listener = TcpListener::bind("127.0.0.1:0")
+        .await
+        .expect("bind WebSocket listener");
+    let base_url = format!(
+        "http://{}",
+        listener.local_addr().expect("listener address")
+    );
+    let server = tokio::spawn(async move {
+        let (stream, _) = listener
+            .accept()
+            .await
+            .expect("accept WebSocket connection");
+        let mut websocket = accept_codex_test_websocket(stream).await;
+        let _request = websocket
+            .next()
+            .await
+            .expect("WebSocket request")
+            .expect("valid WebSocket request");
+        for event in [
+            json!({
+                "type": "response.created",
+                "response": {"id": "resp_structural", "model": "gpt-5.4"}
+            }),
+            json!({
+                "type": "response.in_progress",
+                "response": {"id": "resp_structural", "model": "gpt-5.4"}
+            }),
+            json!({
+                "type": "response.output_item.added",
+                "output_index": 0,
+                "item": {
+                    "id": "msg_structural",
+                    "type": "message",
+                    "role": "assistant",
+                    "status": "in_progress",
+                    "content": []
+                }
+            }),
+        ] {
+            websocket
+                .send(Message::Text(event.to_string().into()))
+                .await
+                .expect("send structural WebSocket event");
+        }
+        websocket
+            .close(Some(CloseFrame {
+                code: CloseCode::Normal,
+                reason: "".into(),
+            }))
+            .await
+            .expect("close WebSocket");
+    });
+
+    let mut stream = provider_with_base_url(&store, base_url)
+        .execute(
+            planned_request("openai", generate_operation()),
+            context("req_websocket_normal_close", CancellationToken::new()),
+        )
+        .await
+        .expect("prepare WebSocket provider stream");
+    let error = loop {
+        match stream.next().await {
+            Some(Ok(event)) => assert!(
+                !event.has_client_event(),
+                "structural events must remain behind the replay boundary"
+            ),
+            Some(Err(error)) => break error,
+            None => panic!("WebSocket close must surface a provider error"),
+        }
+    };
+    server.await.expect("WebSocket server");
+
+    assert_eq!(
+        error.pre_delivery_retry(),
+        Some(PreDeliveryRetry::SameAccountTransportFallback),
+        "unexpected provider error: {error:?}"
+    );
+    assert_eq!(
+        error.upstream_code().map(|code| code.as_str()),
+        Some("websocket_close_1000")
+    );
+}
+
+#[tokio::test]
+async fn fallback_attempt_transport_forces_http_sse_for_a_websocket_request() {
+    let store = Arc::new(MemoryAccountStore::default());
+    create_account(&store, "acct_http_sse_exhausted").await;
+    let server = MockServer::start().await;
+    Mock::given(method("POST"))
+        .and(path("/codex/responses"))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "text/event-stream")
+                .set_body_string(CAPTURE_COMPLETED_SSE),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+
+    let mut stream = provider_with_base_url(&store, server.uri())
+        .execute(
+            planned_request("openai", generate_operation()),
+            fallback_transport_context("req_fallback_transport_http"),
+        )
+        .await
+        .expect("prepare fallback HTTP stream");
+    while let Some(event) = stream.next().await {
+        event.expect("fallback HTTP response");
+    }
 }
 
 #[tokio::test]

backend/crates/providers/openai/tests/transport/canonical.rs

@@ -854,9 +854,10 @@ fn decoder_should_preserve_changed_upstream_response_ids_as_wire() {
 }
 
 fn assert_failed_event(code: &str, marker: &str) {
-    let body = format!(
-        "event: response.failed\ndata: {{\"response\":{{\"id\":\"resp_failed\",\"status\":\"failed\",\"error\":{{\"code\":\"{code}\",\"message\":\"{marker}\"}}}}}}\n\n"
+    let raw_error = format!(
+        "{{\"response\":{{\"id\":\"resp_failed\",\"status\":\"failed\",\"error\":{{\"code\":\"{code}\",\"message\":\"{marker}\"}}}}}}"
     );
+    let body = format!("event: response.failed\ndata: {raw_error}\n\n");
     let failure = CodexCanonicalDecoder::new("fallback")
         .push(body.as_bytes())
         .expect_err("failed event must become a typed error");
@@ -865,6 +866,7 @@ fn assert_failed_event(code: &str, marker: &str) {
         panic!("response.failed must preserve its typed upstream failure");
     };
     assert_eq!(upstream.upstream_code.as_deref(), Some(code));
+    assert_eq!(upstream.raw_body(), raw_error);
     assert!(!failure.semantic_output_seen());
     assert!(!format!("{failure:?}").contains(marker));
 }

backend/crates/providers/openai/tests/transport/headers.rs

@@ -32,6 +32,8 @@ fn request_with_opaque_headers(use_websocket: bool) -> CodexResponsesRequest {
                 ],
                 ["user-agent", STANDARD.encode(b"Codex future-client")],
                 ["originator", STANDARD.encode(b"future-originator")],
+                ["version", STANDARD.encode(b"26.999.10001")],
+                ["version", STANDARD.encode(b"26.999.10002")],
                 ["openai-beta", STANDARD.encode(b"future_responses=v2")],
                 ["openai-beta", STANDARD.encode(b"future_tools=v3")],
                 [
@@ -321,7 +323,7 @@ async fn backend_websocket_should_forward_context_headers_and_preserve_payload_f
         ("x-codex-turn-metadata", "{\"thread_source\":\"subagent\"}"),
         ("x-codex-beta-features", "feature-a"),
         ("x-responsesapi-include-timing-metrics", "true"),
-        ("version", "26.318.11754"),
+        ("version", "1.2.3"),
         ("x-codex-window-id", "cw_derived"),
         ("x-codex-parent-thread-id", "parent-456"),
         ("x-openai-subagent", "future_codex_mode"),
@@ -356,14 +358,17 @@ async fn backend_http_should_restore_opaque_multivalue_header_bytes_and_lease_id
         request
     });
     let request = request_with_opaque_headers(false);
-    let expected_user_agent = test_wire_profile().snapshot().user_agent();
+    let profile = test_wire_profile();
+    let profile_snapshot = profile.snapshot();
+    let expected_user_agent = profile_snapshot.user_agent();
+    let expected_desktop_version = profile_snapshot.desktop_version;
     let client = CodexBackendClient::new(
         reqwest::Client::builder()
             .no_proxy()
             .build()
             .expect("HTTP client"),
         format!("http://{address}"),
-        test_wire_profile(),
+        profile,
     );
 
     client
@@ -374,6 +379,7 @@ async fn backend_http_should_restore_opaque_multivalue_header_bytes_and_lease_id
                 account_id: Some("lease-account"),
                 installation_id: Some("lease-installation"),
                 turn_state: request.turn_state.as_deref(),
+                version: Some("26.825.51511"),
                 ..request_context("req_opaque_http", Some("lease-account"))
             },
         )
@@ -413,6 +419,10 @@ async fn backend_http_should_restore_opaque_multivalue_header_bytes_and_lease_id
         raw_header_values(&raw, "originator"),
         vec![b"codex_cli_rs".to_vec()]
     );
+    assert_eq!(
+        raw_header_values(&raw, "version"),
+        vec![expected_desktop_version.into_bytes()]
+    );
     for dropped in [
         "openai-beta",
         "x-oai-attestation",
@@ -490,6 +500,7 @@ async fn backend_websocket_should_drop_only_unrepresentable_opaque_header_values
                 account_id: Some("lease-account"),
                 installation_id: Some("lease-installation"),
                 turn_state: request.turn_state.as_deref(),
+                version: Some("26.825.51511"),
                 ..request_context("req_opaque_ws", Some("lease-account"))
             },
         )
@@ -526,6 +537,7 @@ async fn backend_websocket_should_drop_only_unrepresentable_opaque_header_values
         vec![test_wire_profile().snapshot().user_agent().into_bytes()]
     );
     assert_eq!(values("originator"), vec![b"codex_cli_rs".to_vec()]);
+    assert_eq!(values("version"), vec![b"1.2.3".to_vec()]);
     assert_eq!(
         values("x-openai-internal-codex-residency"),
         vec![b"us".to_vec()]
@@ -569,7 +581,9 @@ async fn backend_http_should_send_codex_context_without_browser_headers() {
     request.codex_window_id = Some("cw_1".to_owned());
     request.parent_thread_id = Some("parent-1".to_owned());
     let profile = test_wire_profile();
-    let expected_user_agent = profile.snapshot().user_agent();
+    let profile_snapshot = profile.snapshot();
+    let expected_user_agent = profile_snapshot.user_agent();
+    let expected_desktop_version = profile_snapshot.desktop_version;
     let client = CodexBackendClient::new(
         reqwest::Client::builder()
             .no_proxy()
@@ -629,6 +643,10 @@ async fn backend_http_should_send_codex_context_without_browser_headers() {
             Some("turn-state"),
         )
     );
+    assert_eq!(
+        read_header_value(&raw_request, "version"),
+        Some(expected_desktop_version.as_str())
+    );
     for required in [
         "authorization",
         "chatgpt-account-id",

backend/crates/providers/openai/tests/transport/latency.rs

@@ -1117,6 +1117,10 @@ async fn websocket_failure_after_first_delivery_should_not_open_http_fallback()
     let CodexWebSocketExchangeError::ClosedBeforeTerminal(close) = *source else {
         panic!("expected upstream close frame source");
     };
+    assert!(
+        close.connection_id().is_some(),
+        "close failures must retain their WebSocket connection correlation"
+    );
     assert_eq!(close.code(), Some(1009));
     assert_eq!(close.reason(), Some("message too big after output"));
 }

backend/crates/providers/openai/tests/transport/mod.rs

@@ -54,6 +54,7 @@ mod headers;
 mod http_client;
 mod latency;
 mod profile;
+mod profile_avatar;
 mod protocol;
 mod request;
 mod reset_credits;
@@ -233,6 +234,7 @@ async fn collect_backend_response(
     let CodexBackendStreamingResponse {
         mut body,
         transport,
+        websocket_connection_id: _,
         mut turn_state,
         set_cookie_headers,
         mut rate_limit_headers,

backend/crates/providers/openai/tests/transport/profile_avatar.rs

@@ -0,0 +1,80 @@
+use futures::TryStreamExt as _;
+use provider_openai::transport::{CodexProfileAvatarFetchError, fetch_profile_avatar};
+use wiremock::matchers::{method, path};
+use wiremock::{Mock, MockServer, ResponseTemplate};
+
+const OFFICIAL_AVATAR_SOURCE: &str =
+    "https://chatgpt.com/backend-api/estuary/public_content/enc/opaque-token=";
+
+#[tokio::test]
+async fn profile_avatar_streams_unrestricted_content_type_and_body_size() {
+    let server = MockServer::start().await;
+    let body = vec![b'x'; 1024 * 1024 + 1];
+    Mock::given(method("GET"))
+        .and(path("/estuary/public_content/enc/opaque-token="))
+        .respond_with(
+            ResponseTemplate::new(200)
+                .insert_header("content-type", "application/x-avatar-fixture")
+                .insert_header("etag", "\"avatar-v1\"")
+                .set_body_bytes(body.clone()),
+        )
+        .expect(1)
+        .mount(&server)
+        .await;
+    let client = reqwest::Client::builder()
+        .no_proxy()
+        .redirect(reqwest::redirect::Policy::none())
+        .build()
+        .expect("client");
+
+    let avatar = fetch_profile_avatar(
+        &client,
+        &server.uri(),
+        "codex_cli_rs/1.0.0 (linux; x86_64)",
+        OFFICIAL_AVATAR_SOURCE,
+    )
+    .await
+    .expect("profile avatar");
+    let content_type = avatar.content_type.clone();
+    let content_length = avatar.content_length;
+    let etag = avatar.etag.clone();
+    let chunks = avatar.body.try_collect::<Vec<_>>().await.expect("body");
+    let streamed = chunks.into_iter().flatten().collect::<Vec<_>>();
+    let requests = server.received_requests().await.expect("avatar request");
+    let headers = &requests.first().expect("one avatar request").headers;
+
+    assert_eq!(
+        content_type.as_deref(),
+        Some("application/x-avatar-fixture")
+    );
+    assert_eq!(content_length, Some(body.len() as u64));
+    assert_eq!(etag.as_deref(), Some("\"avatar-v1\""));
+    assert_eq!(streamed, body);
+    assert_eq!(
+        headers.get("accept").and_then(|value| value.to_str().ok()),
+        Some("image/avif,image/webp,image/apng,image/svg+xml,image/*,*/*;q=0.8")
+    );
+    assert_eq!(
+        headers
+            .get("user-agent")
+            .and_then(|value| value.to_str().ok()),
+        Some("codex_cli_rs/1.0.0 (linux; x86_64)")
+    );
+}
+
+#[tokio::test]
+async fn profile_avatar_rejects_non_official_sources_before_request() {
+    let client = reqwest::Client::new();
+
+    for source in [
+        "https://example.com/backend-api/estuary/public_content/enc/token",
+        "https://chatgpt.com/other/token",
+        "https://chatgpt.com/backend-api/estuary/public_content/enc/token?next=1",
+        "https://chatgpt.com/backend-api/estuary/public_content/enc/",
+    ] {
+        let error = fetch_profile_avatar(&client, "http://127.0.0.1:9", "test-agent", source)
+            .await
+            .expect_err("invalid source");
+        assert!(matches!(error, CodexProfileAvatarFetchError::InvalidSource));
+    }
+}

deploy/Dockerfile

@@ -13,7 +13,7 @@ RUN npm install --global pnpm@11.7.0 \
 COPY frontend ./
 RUN pnpm build
 
-FROM rust:1.98-bookworm@sha256:e70e2eec3d495fd5c8e0be74adda86507dfac7f51a724fbf9813ff59b2b247c7 AS backend-builder
+FROM rust:1.98-bookworm@sha256:82150a52ec202c1b14d7817e14516c392bb7f5cfebd88f1ed531cb37ebd39922 AS backend-builder
 
 WORKDIR /app/backend
 ARG TARGETARCH
@@ -40,7 +40,7 @@ RUN --mount=type=cache,target=/usr/local/cargo/registry \
 # 备份客户端来源：与 compose 服务端同一固定镜像，版本一致。
 FROM ${POSTGRES_IMAGE} AS pg-client
 
-FROM debian:bookworm-slim@sha256:abd67ffcfa541b485a3dff59865ab629aa048a6c613e639d36e7456b0b229241 AS runtime-base
+FROM debian:bookworm-slim@sha256:88200866dfff7ea7f5cbcb6ec7c8a701889efe6fe859fe64d6990e4b07ea4171 AS runtime-base
 
 ENV TZ=Asia/Shanghai
 

deploy/config.example.yaml

@@ -63,25 +63,25 @@ openai:
     # 版本元组来自同一个官方 macOS Desktop ZIP；Provider 每 24 小时检查 appcast，
     # 仅在包内 Core 核验和 Redis 条件覆盖都成功后原子更新。
     originator: 'Codex Desktop'
-    codex_version: '0.147.0-alpha.6.6'
-    desktop_version: '26.803.81509'
-    desktop_build: '6415'
+    codex_version: '0.151.0-alpha.7.2'
+    desktop_version: '26.825.51511'
+    desktop_build: '7377'
     os_type: 'Mac OS'
     os_version: '15.7.1'
     arch: 'arm64'
     terminal: 'unknown'
-    verified_at: '2026-08-03T00:00:00+08:00'
+    verified_at: '2026-08-31T00:00:00+08:00'
 
 xai:
   # OAuth 端点、额度与模型目录策略由 xAI Provider 固定管理；这里只声明请求画像启动基线。
   wire_profile:
     # Provider 每 24 小时读取官方 npm metadata，仅在进程内更新 client_version。
-    client_identifier: 'grok-shell'
-    client_version: '0.2.118'
+    client_identifier: 'GrokShell'
+    client_version: '1.0.13'
     client_mode: 'headless'
     target_os: 'linux'
     target_arch: 'x86_64'
-    verified_at: '2026-07-21T00:00:00+08:00'
+    verified_at: '2026-08-31T00:00:00+08:00'
 
 # Compose 凭据桥接区；密码仍只维护在 store 中。
 services:

frontend/package.json

@@ -19,27 +19,27 @@
     "@boxicons/vue": "1.0.1",
     "@fontsource-variable/inter": "^5.3.0",
     "@fontsource-variable/jetbrains-mono": "^5.3.0",
-    "@lucide/vue": "^1.33.0",
+    "@lucide/vue": "^1.37.0",
     "@vueuse/core": "^14.4.0",
-    "axios": "^1.19.0",
+    "axios": "^1.20.0",
     "dayjs": "^1.11.23",
     "dompurify": "^3.4.14",
     "echarts": "^6.1.0",
-    "es-toolkit": "^1.51.0",
+    "es-toolkit": "^1.52.0",
     "gsap": "^3.15.0",
-    "marked": "^18.0.10",
+    "marked": "^18.0.11",
     "pinia": "^4.0.3",
     "pinia-plugin-persistedstate": "^4.7.1",
-    "vue": "^3.5.41",
-    "vue-router": "^5.2.0"
+    "vue": "^3.5.42",
+    "vue-router": "^5.3.0"
   },
   "devDependencies": {
     "@antfu/eslint-config": "^9.3.0",
     "@tailwindcss/vite": "^4.3.3",
-    "@types/node": "^26.2.0",
+    "@types/node": "^26.4.0",
     "@vitejs/plugin-vue": "^6.0.8",
     "@vue/tsconfig": "^0.9.1",
-    "eslint": "^10.9.0",
+    "eslint": "^10.9.1",
     "eslint-plugin-format": "^2.0.1",
     "eslint-plugin-vuejs-accessibility": "^2.6.0",
     "tailwindcss": "^4.3.3",

frontend/src/api/modules/accounts.ts

@@ -368,6 +368,21 @@ export function getAccountProfileStatistics(data: AccountIdParam) {
   })
 }
 
+export function accountProfileAvatarUrl(accountId: string, sourceUrl: string) {
+  const params = new URLSearchParams({
+    accountId,
+    version: stableAvatarVersion(sourceUrl),
+  })
+  return `/api/admin/accounts/profile-avatar?${params.toString()}`
+}
+
+function stableAvatarVersion(value: string) {
+  let hash = 0
+  for (const character of value)
+    hash = (hash * 33 + (character.codePointAt(0) ?? 0)) % 2_147_483_647
+  return hash.toString(36)
+}
+
 export function refreshAccountQuota(data: AccountIdParam) {
   return request<AccountQuotaResponse>({
     url: '/api/admin/accounts/quota/refresh',

frontend/src/api/modules/usage.ts

@@ -211,19 +211,36 @@ export interface OpsError {
   requestId: string | null
   clientApiKeyId: string | null
   kind: string
+  operation: string
+  protocol: string | null
+  clientTransport: string | null
   provider: string | null
   authenticationKind: string | null
   accountId: string | null
+  accountName: string | null
+  accountEmail: string | null
   route: string
   model: string | null
+  requestedModel: string | null
+  upstreamModel: string | null
+  serviceTier: string | null
   clientStatusCode: number | null
   upstreamStatusCode: number | null
   transport: string | null
   attemptIndex: number | null
   failureClass: string
+  providerErrorCode: string | null
+  occurrenceCount: number
   responseId: string | null
   upstreamRequestId: string | null
   latencyMs: number | null
+  clientIp: string | null
+  userAgent: string | null
+  reasoningEffort: string | null
+  reasoningPreset: string | null
+  requestKind: string | null
+  subagentKind: string | null
+  compact: boolean | null
   message: string
   metadata: OpsErrorMetadata
   createdAt: string

frontend/src/components/base/BaseRadio.vue

@@ -27,7 +27,7 @@ const indicatorClasses = computed(() => [
     ? 'bg-cp-bg-container-disabled text-cp-text-disabled'
     : checked.value
       ? 'bg-cp-primary text-(--cp-button-primary-color)'
-      : 'bg-cp-fill-tertiary text-transparent group-hover:bg-cp-bg-text-active',
+      : 'bg-cp-fill-secondary text-transparent',
 ])
 </script>
 

frontend/src/components/charts/timeSeriesGap.ts

@@ -0,0 +1,121 @@
+import type { LineSeriesOption } from 'echarts'
+
+type TemporalValue = number | null | undefined
+
+interface GapRun {
+  startIndex: number
+  endIndex: number
+}
+
+interface GapBridgeOptions {
+  name: string
+  color: string
+  xAxisIndex?: number
+  yAxisIndex?: number
+  width?: number
+  z?: number
+  maxGapBuckets?: number
+}
+
+const defaultShortGapBuckets = 2
+
+export function sampleGapBridgeSeries(
+  values: TemporalValue[],
+  options: GapBridgeOptions,
+): LineSeriesOption[] {
+  const data = values.map(normalizeValue)
+  const maxGapBuckets = options.maxGapBuckets ?? defaultShortGapBuckets
+  const series: LineSeriesOption[] = []
+
+  for (const [runIndex, run] of boundedGapRuns(data)
+    .filter(run => gapLength(run) <= maxGapBuckets)
+    .entries()) {
+    const beforeIndex = run.startIndex - 1
+    const afterIndex = run.endIndex + 1
+    const beforeValue = data[beforeIndex]
+    const afterValue = data[afterIndex]
+    const bridge = Array.from<number | null>({ length: data.length }).fill(null)
+
+    if (beforeValue == null || afterValue == null)
+      continue
+
+    const span = afterIndex - beforeIndex
+    for (let index = beforeIndex; index <= afterIndex; index += 1) {
+      const progress = (index - beforeIndex) / span
+      bridge[index] = beforeValue + (afterValue - beforeValue) * progress
+    }
+
+    series.push({
+      name: `${options.name}-gap-${runIndex}`,
+      type: 'line',
+      data: bridge,
+      connectNulls: false,
+      smooth: false,
+      showSymbol: false,
+      silent: true,
+      xAxisIndex: options.xAxisIndex ?? 0,
+      yAxisIndex: options.yAxisIndex ?? 0,
+      z: Math.max(0, (options.z ?? 2) - 1),
+      lineStyle: {
+        color: options.color,
+        type: 'dashed',
+        width: Math.max(1, (options.width ?? 2.2) - 0.7),
+        opacity: 0.32,
+      },
+      itemStyle: { color: options.color, opacity: 0 },
+      emphasis: { disabled: true },
+      tooltip: { show: false },
+    })
+  }
+
+  return series
+}
+
+export function requestActivityByBucket(
+  buckets: string[],
+  activity: Array<{ bucket: string, totalRequests: number }>,
+) {
+  const requestsByBucket = new Map(
+    activity.map(point => [point.bucket, Math.max(0, point.totalRequests)]),
+  )
+  return buckets.map(bucket => (requestsByBucket.get(bucket) ?? 0) > 0)
+}
+
+export function zeroInactiveValues(
+  values: TemporalValue[],
+  active: boolean[],
+) {
+  return values.map((value, index) => normalizeValue(value) ?? (active[index] === false ? 0 : null))
+}
+
+function normalizeValue(value: TemporalValue) {
+  return typeof value === 'number' && Number.isFinite(value) ? value : null
+}
+
+function boundedGapRuns(values: Array<number | null>) {
+  return gapRuns(values.map(value => value == null)).filter(
+    run => run.startIndex > 0 && run.endIndex < values.length - 1,
+  )
+}
+
+function gapRuns(isGap: boolean[]) {
+  const runs: GapRun[] = []
+  let startIndex = -1
+
+  for (let index = 0; index <= isGap.length; index += 1) {
+    if (isGap[index] && startIndex < 0) {
+      startIndex = index
+      continue
+    }
+    if (isGap[index] || startIndex < 0)
+      continue
+    runs.push({ startIndex, endIndex: index - 1 })
+    startIndex = -1
+  }
+
+  return runs
+}
+
+function gapLength(run: GapRun) {
+  return run.endIndex - run.startIndex + 1
+}

frontend/src/views/accounts/components/AccountProfileModal/ProfileHero.vue

@@ -4,6 +4,7 @@ import type { AccountProfileStatisticsResponse } from '@/api'
 import { UserRound } from '@lucide/vue'
 import { computed, shallowRef, watch } from 'vue'
 
+import { accountProfileAvatarUrl } from '@/api'
 import { formatCompactNumber, formatInteger } from '@/utils/number'
 import { stablePresetVisualToneClass } from '../../utils/visualTone'
 import AccountPlanBadge from '../AccountPlanBadge.vue'
@@ -23,6 +24,10 @@ const initial = computed(() => Array.from(displayName.value.trim())[0]?.toUpperC
 const avatarToneClass = computed(() =>
   stablePresetVisualToneClass(props.account.id || accountIdentity.value || displayName.value),
 )
+const avatarUrl = computed(() => {
+  const sourceUrl = props.profile.imageUrl?.trim()
+  return sourceUrl ? accountProfileAvatarUrl(props.account.id, sourceUrl) : null
+})
 const metrics = computed(() => [
   {
     label: '累计 Token 数',
@@ -49,7 +54,7 @@ const metrics = computed(() => [
 ])
 
 watch(
-  () => props.profile.imageUrl,
+  avatarUrl,
   () => {
     imageFailed.value = false
   },
@@ -95,8 +100,8 @@ function formatDuration(value: number | null) {
         :class="avatarToneClass"
       >
         <img
-          v-if="profile.imageUrl && !imageFailed"
-          :src="profile.imageUrl"
+          v-if="avatarUrl && !imageFailed"
+          :src="avatarUrl"
           :alt="`${displayName} 的头像`"
           class="size-full object-cover"
           referrerpolicy="no-referrer"

frontend/src/views/accounts/index.vue

@@ -157,7 +157,7 @@ const {
 </script>
 
 <template>
-  <div class="flex h-full min-h-0 w-full flex-col overflow-hidden">
+  <div class="flex min-h-0 w-full flex-col xl:h-full xl:overflow-hidden">
     <BasePageHeader
       class="h-17"
       title="账号管理"
@@ -167,7 +167,7 @@ const {
     <AccountOverviewCards :summary="accountSummary" />
 
     <BaseCard
-      class="mt-4 flex h-[calc(100dvh-250px)] min-h-125 flex-col"
+      class="mt-4 flex flex-col xl:h-[calc(100dvh-250px)] xl:min-h-125"
     >
       <template #header>
         <AccountFilters
@@ -188,9 +188,9 @@ const {
       </template>
 
       <template #body>
-        <div class="flex h-full min-h-0 flex-col">
+        <div class="flex min-h-0 flex-col xl:h-full">
           <BaseTable
-            class="min-h-0 flex-1 [--cp-table-row-height:72px]"
+            class="h-100! min-h-100 flex-none [--cp-table-row-height:72px] xl:h-auto! xl:min-h-0 xl:flex-1"
             :columns="accountColumns"
             :rows="accounts"
             :loading="loading"

frontend/src/views/dashboard/composables/useDashboard.ts

@@ -373,10 +373,10 @@ function aggregateUsageTrend(points: DashboardTrendPoint[]) {
     )
     const uncachedInputTokensValue = inputTokensValue - cachedTokensValue
     const effectiveTokensValue = uncachedInputTokensValue + outputTokensValue
-    const cacheHitRateValue = inputTokensValue ? cachedTokensValue / inputTokensValue : null
+    const cacheHitRateValue = inputTokensValue ? cachedTokensValue / inputTokensValue : 0
     const successRateValue = requestsValue
       ? ((requestsValue - errorsValue) / requestsValue) * 100
-      : null
+      : 0
 
     return {
       ...first,
@@ -392,12 +392,12 @@ function aggregateUsageTrend(points: DashboardTrendPoint[]) {
       uncachedInputTokensValue,
       effectiveTokens: formatCompactNumber(effectiveTokensValue),
       effectiveTokensValue: effectiveTokensValue > 0 ? effectiveTokensValue : null,
-      cacheHitRate: cacheHitRateValue === null ? '—' : formatDashboardRate(cacheHitRateValue),
+      cacheHitRate: formatDashboardRate(cacheHitRateValue),
       cacheHitRateValue,
       tokensValue: inputTokensValue + outputTokensValue,
       errors: formatCompactNumber(errorsValue),
       errorsValue,
-      successRate: successRateValue === null ? '—' : `${successRateValue.toFixed(1)}%`,
+      successRate: `${successRateValue.toFixed(1)}%`,
       successRateValue,
     }
   })

frontend/src/views/dashboard/composables/useRequestTrendChart.ts

@@ -4,6 +4,7 @@ import type { dashboardTrendView, normalizeDashboardTrendKind } from './useDashb
 import { usePreferredReducedMotion } from '@vueuse/core'
 import { computed, shallowRef, watch } from 'vue'
 
+import { sampleGapBridgeSeries } from '@/components/charts/timeSeriesGap'
 import { chartTooltipStyle, tooltipIndex } from '@/components/charts/tooltip'
 import { useChartPalette } from '@/composables/useChartPalette'
 
@@ -197,7 +198,7 @@ export function useRequestTrendChart(options: {
         ),
         tooltipItem(
           '缓存命中',
-          trendPointText(point, 'cacheHitRate'),
+          zeroAwareRateText(point, 'cacheHitRate', 'inputTokensValue'),
           trendColor('缓存', '--cp-color-text-tertiary', '#94A3B8'),
         ),
         tooltipItem('请求', point?.requests, palette.value.textSecondary),
@@ -235,19 +236,19 @@ export function useRequestTrendChart(options: {
     if (name === '错误数')
       return point?.errors ?? value
     if (name === '成功率')
-      return point?.successRate ?? value
+      return zeroAwareRateText(point, 'successRate', 'requestsValue') ?? value
     if (name === '总请求')
       return point?.requests ?? value
     return value
   }
 
-  function getSeries() {
+  function getSeries(): Array<BarSeriesOption | LineSeriesOption> {
     if (activeKind.value === 'usage') {
       const cacheColor = trendColor('缓存', '--cp-color-text-tertiary', '#94A3B8')
       const inputColor = trendColor('输入', '--cp-color-blue-solid', '#5983F4')
       const outputColor = trendColor('输出', '--cp-color-green-solid', '#12B981')
       return [
-        lineSeries('缓存', activeSeriesValues('cachedTokensValue'), cacheColor, {
+        lineSeries('缓存', seriesValues('cachedTokensValue'), cacheColor, {
           area: true,
           areaStartAlpha: '30',
           areaEndAlpha: '08',
@@ -257,7 +258,7 @@ export function useRequestTrendChart(options: {
           width: 1.25,
           z: 1,
         }),
-        lineSeries('输入', activeSeriesValues('uncachedInputTokensValue'), inputColor, {
+        lineSeries('输入', seriesValues('uncachedInputTokensValue'), inputColor, {
           area: true,
           areaStartAlpha: '2A',
           areaEndAlpha: '05',
@@ -266,7 +267,7 @@ export function useRequestTrendChart(options: {
           width: 2.3,
           z: 3,
         }),
-        lineSeries('输出', activeSeriesValues('outputTokensValue'), outputColor, {
+        lineSeries('输出', seriesValues('outputTokensValue'), outputColor, {
           smooth: 0.24,
           width: 2.1,
           yAxisIndex: 1,
@@ -277,19 +278,19 @@ export function useRequestTrendChart(options: {
 
     if (activeKind.value === 'latency') {
       return [
-        lineSeries(
+        ...gapLineSeries(
           '总耗时 P95',
           activeSeriesValues('latencyP95Ms'),
           trendColor('总耗时', '--cp-color-orange-solid', '#F59E0B'),
           { lineType: 'dashed', smooth: 0.2, width: 1.8, z: 2 },
         ),
-        lineSeries(
+        ...gapLineSeries(
           '首字 P95',
           activeSeriesValues('firstTokenP95Ms'),
           trendColor('首字', '--cp-color-cyan-solid', '#13C2C2'),
           { area: true, smooth: 0.24, width: 2.5, z: 4 },
         ),
-        lineSeries(
+        ...gapLineSeries(
           '吞吐 P50',
           activeSeriesValues('outputThroughputP50'),
           trendColor('吞吐', '--cp-color-green-solid', '#12B981'),
@@ -304,9 +305,9 @@ export function useRequestTrendChart(options: {
         seriesValues('errorsValue'),
         trendColor('错误', '--cp-color-red-solid', '#EF4444'),
       ),
-      lineSeries(
+      ...gapLineSeries(
         '成功率',
-        seriesValues('successRateValue'),
+        activeSeriesValues('successRateValue'),
         trendColor('成功', '--cp-color-green-solid', '#12B981'),
         { width: 2.4, yAxisIndex: 1 },
       ),
@@ -325,7 +326,7 @@ export function useRequestTrendChart(options: {
 
   function activeSeriesValues(key: string) {
     return points.value.map(point =>
-      Number(point.requestsValue) > 0 ? trendPointNumber(point, key) : null,
+      Number(point.requestsValue) > 0 ? trendPointNumber(point, key) : 0,
     )
   }
 
@@ -377,6 +378,26 @@ export function useRequestTrendChart(options: {
     }
   }
 
+  function gapLineSeries(
+    name: string,
+    data: (number | null)[],
+    color: string,
+    lineOptions: LineSeriesOptions = {},
+  ) {
+    const primary = lineSeries(name, data, color, lineOptions)
+    return [
+      primary,
+      ...sampleGapBridgeSeries(data, {
+        name,
+        color,
+        width: lineOptions.width,
+        xAxisIndex: lineOptions.xAxisIndex,
+        yAxisIndex: lineOptions.yAxisIndex,
+        z: lineOptions.z,
+      }),
+    ]
+  }
+
   function barSeries(
     name: string,
     data: (number | null)[],
@@ -490,7 +511,7 @@ function tooltipValue(source: unknown, key: string) {
 function trendPointProperty(point: TrendPoint | undefined, key: string) {
   if (!point || !(key in point))
     return undefined
-  return (point as Record<string, unknown>)[key]
+  return (point as unknown as Record<string, unknown>)[key]
 }
 
 function trendPointText(point: TrendPoint | undefined, key: string) {
@@ -498,6 +519,17 @@ function trendPointText(point: TrendPoint | undefined, key: string) {
   return typeof value === 'string' ? value : undefined
 }
 
+function zeroAwareRateText(
+  point: TrendPoint | undefined,
+  valueKey: string,
+  activityKey: string,
+) {
+  const activity = trendPointProperty(point, activityKey)
+  if (typeof activity === 'number' && activity <= 0)
+    return '0.0%'
+  return trendPointText(point, valueKey)
+}
+
 function trendPointNumber(point: TrendPoint, key: string) {
   const value = trendPointProperty(point, key)
   return typeof value === 'number' && Number.isFinite(value) ? value : null

frontend/src/views/usage/components/OpsErrorDetailModal.vue

@@ -6,6 +6,7 @@ import BaseModal from '@/components/base/BaseModal/index.vue'
 import { displayValue } from '../utils/detail'
 import { presentOpsError } from '../utils/opsErrorPresentation'
 import UsageDetailCodePanel from './UsageDetailCodePanel.vue'
+import UsageDetailFieldGrid from './UsageDetailFieldGrid.vue'
 import UsageStatusCodeBadge from './UsageStatusCodeBadge.vue'
 
 const props = defineProps<{
@@ -16,23 +17,52 @@ const open = defineModel<boolean>({ default: false })
 
 const presentation = computed(() => props.record ? presentOpsError(props.record) : null)
 
-const fields = computed(() => [
-  { label: '账号', value: props.record?.metadata.accountLabel },
-  { label: '时间', value: props.record?.createdAtDisplay },
+const panelClass = 'min-w-0 rounded-cp-card bg-cp-fill-quaternary px-4 py-3.5'
+const panelTitleClass = 'm-0 text-cp-sm leading-none font-heavy text-cp-text-secondary'
+
+const accountLabel = computed(() => props.record?.accountEmail
+  || props.record?.accountName
+  || props.record?.metadata.accountLabel
+  || props.record?.accountId)
+
+const requestFields = computed(() => [
+  { label: '客户端 IP', value: props.record?.clientIp, mono: true },
+  { label: 'User-Agent', value: props.record?.userAgent, mono: true, wrap: true },
+  { label: '协议', value: props.record?.protocol, mono: true },
+  { label: '客户端传输', value: props.record?.clientTransport, mono: true },
+  { label: '客户端 Key ID', value: props.record?.clientApiKeyId, mono: true },
+  { label: '请求 ID', value: props.record?.requestId, mono: true },
+  { label: '响应 ID', value: props.record?.responseId, mono: true },
+  { label: '上游请求 ID', value: props.record?.upstreamRequestId, mono: true },
+])
+
+const routeFields = computed(() => [
+  { label: '端点', value: props.record?.route, mono: true },
+  { label: '请求模型', value: props.record?.requestedModel, mono: true },
+  { label: '上游模型', value: props.record?.upstreamModel, mono: true },
+  { label: '记录模型', value: props.record?.model, mono: true },
+  { label: '推理强度', value: props.record?.reasoningEffort, mono: true },
+  { label: '推理预设', value: props.record?.reasoningPreset, mono: true },
+  { label: '请求类型', value: props.record?.requestKind, mono: true },
+  { label: '子代理类型', value: props.record?.subagentKind, mono: true },
+  { label: '压缩请求', value: booleanDisplay(props.record?.compact) },
+  { label: '服务档位', value: props.record?.serviceTier, mono: true },
+  { label: '上游传输', value: props.record?.transport, mono: true },
+  { label: '尝试序号', value: props.record?.attemptIndex },
+])
+
+const diagnosticFields = computed(() => [
+  { label: '账号', value: accountLabel.value, mono: true },
+  { label: '时间', value: props.record?.createdAtDisplay, mono: true },
   { label: '记录来源', value: presentation.value?.sourceLabel },
   { label: '组件', value: presentation.value?.componentLabel },
+  { label: '操作/触发', value: props.record?.operation, mono: true },
   { label: '失败分类', value: presentation.value?.failureClassLabel },
   { label: '平台/类型', value: providerKindLabel(props.record) },
-  { label: '端点', value: props.record?.route },
-  { label: '模型', value: props.record?.model },
-  { label: '账号 ID', value: props.record?.accountId },
-  { label: '客户端 Key ID', value: props.record?.clientApiKeyId },
-  { label: '传输方式', value: props.record?.transport },
-  { label: '尝试序号', value: props.record?.attemptIndex },
-  { label: '耗时', value: latencyDisplay(props.record?.latencyMs) },
-  { label: '请求 ID', value: props.record?.requestId, wide: true },
-  { label: '响应 ID', value: props.record?.responseId, wide: true },
-  { label: '上游请求 ID', value: props.record?.upstreamRequestId, wide: true },
+  { label: '账号 ID', value: props.record?.accountId, mono: true },
+  { label: 'Provider 错误码', value: props.record?.providerErrorCode, mono: true },
+  { label: '聚合次数', value: props.record?.occurrenceCount },
+  { label: '耗时', value: latencyDisplay(props.record?.latencyMs), mono: true },
 ])
 
 const metadataText = computed(() => {
@@ -46,6 +76,14 @@ function latencyDisplay(value: unknown) {
   return typeof value === 'number' ? `${value} ms` : '—'
 }
 
+function booleanDisplay(value: boolean | null | undefined) {
+  if (value === true)
+    return '是'
+  if (value === false)
+    return '否'
+  return '—'
+}
+
 function providerKindLabel(record: OpsError | null) {
   if (!record?.provider)
     return '—'
@@ -59,7 +97,7 @@ function providerKindLabel(record: OpsError | null) {
   <BaseModal
     v-model="open"
     title="错误明细"
-    description="状态码、失败分类与诊断信息"
+    description="请求来源、链路上下文与原始诊断"
     tone="danger"
     size="xl"
   >
@@ -79,34 +117,37 @@ function providerKindLabel(record: OpsError | null) {
         </p>
       </section>
 
-      <dl
-        class="mt-3 grid grid-cols-1 gap-3 rounded-cp-card bg-cp-fill-quaternary px-4 py-3.5 sm:grid-cols-2"
-      >
-        <div
-          v-for="field in fields"
-          :key="field.label"
-          class="min-w-0"
-          :class="field.wide ? 'sm:col-span-2' : undefined"
-        >
-          <dt class="text-cp-xs leading-none font-bold text-cp-text-quaternary">
-            {{ field.label }}
-          </dt>
-          <dd
-            class="mt-1.5 mb-0 truncate font-mono text-cp-sm leading-normal font-emphasis text-cp-text"
-            :title="displayValue(field.value)"
-          >
-            {{ displayValue(field.value) }}
-          </dd>
-        </div>
-      </dl>
+      <div class="mt-3 grid min-w-0 gap-3 lg:grid-cols-2">
+        <section :class="panelClass">
+          <h3 :class="panelTitleClass">
+            请求追踪
+          </h3>
+          <UsageDetailFieldGrid :items="requestFields" />
+        </section>
 
-      <section class="mt-3 rounded-cp-card bg-cp-fill-quaternary px-4 py-3.5">
+        <section :class="panelClass">
+          <h3 :class="panelTitleClass">
+            模型与链路
+          </h3>
+          <UsageDetailFieldGrid :items="routeFields" />
+        </section>
+      </div>
+
+      <section class="mt-3" :class="panelClass">
+        <h3 :class="panelTitleClass">
+          错误事件
+        </h3>
+        <UsageDetailFieldGrid :items="diagnosticFields" />
+      </section>
+
+      <section class="mt-3" :class="panelClass">
         <UsageDetailCodePanel title="原始诊断" max-height="260px" :content="record.message" />
       </section>
 
       <section
         v-if="metadataText"
-        class="mt-3 rounded-cp-card bg-cp-fill-quaternary px-4 py-3.5"
+        class="mt-3"
+        :class="panelClass"
       >
         <UsageDetailCodePanel title="Metadata" max-height="260px" :content="metadataText" />
       </section>

frontend/src/views/usage/components/OpsErrorPanel.vue

@@ -8,11 +8,13 @@ import BaseIconButton from '@/components/base/BaseIconButton.vue'
 import BaseInput from '@/components/base/BaseInput.vue'
 import BaseTablePagination from '@/components/base/BaseTable/BaseTablePagination.vue'
 import BaseTable from '@/components/base/BaseTable/index.vue'
+import ProviderIconGroup from '@/components/ProviderIconGroup.vue'
 import { useOpsErrorsTable } from '../composables/useOpsErrorsTable'
 import { opsErrorColumns } from '../constants'
 import { presentOpsError } from '../utils/opsErrorPresentation'
 import OpsErrorDetailModal from './OpsErrorDetailModal.vue'
 import UsageStatusCodeBadge from './UsageStatusCodeBadge.vue'
+import UsageTransportBadge from './UsageTransportBadge.vue'
 
 const props = defineProps<{
   timeRangeParams: UsageTimeRangeParams
@@ -46,6 +48,30 @@ function failureClassText(record: OpsError) {
 function errorSummary(record: OpsError) {
   return presentOpsError(record).summary
 }
+
+function accountText(record: OpsError) {
+  return record.accountEmail
+    || record.accountName
+    || record.metadata.accountLabel
+    || record.accountId
+    || '—'
+}
+
+function modelText(record: OpsError) {
+  return record.requestedModel || record.model || record.upstreamModel || '—'
+}
+
+function modelTitle(record: OpsError) {
+  const requested = record.requestedModel
+  const upstream = record.upstreamModel
+  return requested && upstream && requested !== upstream
+    ? `${requested} → ${upstream}`
+    : modelText(record)
+}
+
+function reasoningText(record: OpsError) {
+  return record.reasoningPreset || record.reasoningEffort || '—'
+}
 </script>
 
 <template>
@@ -111,6 +137,12 @@ function errorSummary(record: OpsError) {
             {{ failureClassText(row) }}
           </span>
         </template>
+        <template #provider="{ row }">
+          <ProviderIconGroup
+            :provider="String(row.provider || '')"
+            :authentication-kind="row.authenticationKind"
+          />
+        </template>
         <template #message="{ row }">
           <span class="block max-w-full truncate text-cp-sm font-emphasis text-cp-text" :title="errorSummary(row)">
             {{ errorSummary(row) }}
@@ -119,9 +151,41 @@ function errorSummary(record: OpsError) {
         <template #accountId="{ row }">
           <span
             class="block max-w-full truncate font-mono text-cp-sm font-bold text-cp-text"
-            :title="row.accountId || ''"
+            :title="accountText(row)"
           >
-            {{ row.metadata.accountLabel || '—' }}
+            {{ accountText(row) }}
+          </span>
+        </template>
+        <template #model="{ row }">
+          <span
+            class="block max-w-full truncate font-mono text-cp-sm font-bold text-cp-text"
+            :title="modelTitle(row)"
+          >
+            {{ modelText(row) }}
+          </span>
+        </template>
+        <template #reasoningEffort="{ row }">
+          <span class="text-cp-sm font-bold text-cp-text-secondary">
+            {{ reasoningText(row) }}
+          </span>
+        </template>
+        <template #transport="{ row }">
+          <UsageTransportBadge :transport="row.transport" />
+        </template>
+        <template #clientTransport="{ row }">
+          <UsageTransportBadge :transport="row.clientTransport" />
+        </template>
+        <template #clientIp="{ row }">
+          <span
+            class="inline-flex h-6 max-w-full items-center rounded-full bg-cp-blue-bg px-2.5 font-mono text-cp-sm leading-none font-bold text-cp-blue-text-on-bg"
+            :title="row.clientIp || '—'"
+          >
+            <span class="min-w-0 truncate">{{ row.clientIp || '—' }}</span>
+          </span>
+        </template>
+        <template #userAgent="{ row }">
+          <span class="block max-w-full wrap-break-word whitespace-normal font-mono text-cp-sm leading-[1.4] font-emphasis text-cp-text-secondary">
+            {{ row.userAgent || '—' }}
           </span>
         </template>
         <template #actions="{ row }">

frontend/src/views/usage/components/UsageCostCard.vue

@@ -7,6 +7,10 @@ import BaseCard from '@/components/base/BaseCard.vue'
 import BaseEmpty from '@/components/base/BaseEmpty.vue'
 import BaseSegmented from '@/components/base/BaseSegmented.vue'
 import BaseChart from '@/components/charts/BaseChart.vue'
+import {
+  requestActivityByBucket,
+  zeroInactiveValues,
+} from '@/components/charts/timeSeriesGap'
 import { useChartPalette } from '@/composables/useChartPalette'
 import { formatLocalizedCompactNumber as formatCompactNumber } from '@/utils/number'
 
@@ -14,10 +18,11 @@ import {
   tooltipIndex,
   tooltipRows,
   usageCategoryAxis,
+  usageGapAwareLineSeries,
   usageLegend,
-  usageLineSeries,
   usageTooltip,
   usageTooltipContent,
+  usageTooltipItem,
   usageValueAxis,
 } from '../utils/chart'
 import {
@@ -28,11 +33,13 @@ import {
 } from '../utils/format'
 
 type Cost = Awaited<ReturnType<typeof getUsageRecordInsightsOverview>>['cost']
+type Activity = Awaited<ReturnType<typeof getUsageRecordInsightsOverview>>['health']['points']
 type UsageChartPalette = ReturnType<typeof useChartPalette>['palette']['value']
 
 const props = withDefaults(
   defineProps<{
     cost: Cost
+    activity: Activity
     loading?: boolean
   }>(),
   {
@@ -43,6 +50,10 @@ const props = withDefaults(
 const activeView = shallowRef('cost')
 const { palette } = useChartPalette()
 const points = computed(() => props.cost.points)
+const requestActivity = computed(() => requestActivityByBucket(
+  points.value.map(point => point.bucket),
+  props.activity,
+))
 const hasNoCacheCost = computed(() =>
   points.value.some(point => point.noCacheCost != null),
 )
@@ -74,6 +85,7 @@ const hasData = computed(() => {
 const chartOption = computed<EChartsOption>(() => {
   const theme = palette.value
   const legend = legendNames()
+  const series = chartSeries(theme)
 
   return {
     animationDuration: 240,
@@ -95,7 +107,7 @@ const chartOption = computed<EChartsOption>(() => {
       min: activeView.value === 'cache' ? 0 : undefined,
       max: activeView.value === 'cache' ? 1 : undefined,
     }),
-    series: chartSeries(theme),
+    series,
   }
 })
 
@@ -119,9 +131,12 @@ function chartSeries(theme: UsageChartPalette): LineSeriesOption[] {
   const chartPoints = points.value
   if (activeView.value === 'savings') {
     return [
-      usageLineSeries(
+      ...usageGapAwareLineSeries(
         '缓存节省',
-        chartPoints.map(point => decimalDisplayNumber(point.cacheSavings)),
+        zeroInactiveValues(
+          chartPoints.map(point => decimalDisplayNumber(point.cacheSavings)),
+          requestActivity.value,
+        ),
         theme.success,
         { area: 'strong' },
       ),
@@ -130,12 +145,12 @@ function chartSeries(theme: UsageChartPalette): LineSeriesOption[] {
 
   if (activeView.value === 'cache') {
     return [
-      usageLineSeries(
+      ...usageGapAwareLineSeries(
         '缓存 Token 占比',
         chartPoints.map(point => point.cachedTokenRate),
         theme.normal,
       ),
-      usageLineSeries(
+      ...usageGapAwareLineSeries(
         '命中请求率',
         chartPoints.map(point => point.cacheHitRequestRate),
         theme.success,
@@ -144,18 +159,24 @@ function chartSeries(theme: UsageChartPalette): LineSeriesOption[] {
   }
 
   const series = [
-    usageLineSeries(
+    ...usageGapAwareLineSeries(
       '实际费用',
-      chartPoints.map(point => decimalDisplayNumber(point.estimatedCost)),
+      zeroInactiveValues(
+        chartPoints.map(point => decimalDisplayNumber(point.estimatedCost)),
+        requestActivity.value,
+      ),
       theme.success,
       { area: 'strong' },
     ),
   ]
   if (hasNoCacheCost.value) {
     series.push(
-      usageLineSeries(
+      ...usageGapAwareLineSeries(
         '无缓存费用',
-        chartPoints.map(point => decimalDisplayNumber(point.noCacheCost)),
+        zeroInactiveValues(
+          chartPoints.map(point => decimalDisplayNumber(point.noCacheCost)),
+          requestActivity.value,
+        ),
         theme.textMuted,
       ),
     )
@@ -165,29 +186,48 @@ function chartSeries(theme: UsageChartPalette): LineSeriesOption[] {
 
 function formatTooltip(params: unknown) {
   const rows = tooltipRows(params)
-  const point = points.value[tooltipIndex(rows[0])]
+  const pointIndex = tooltipIndex(rows[0])
+  const point = points.value[pointIndex]
   if (!point)
     return ''
+  const theme = palette.value
 
   if (activeView.value === 'savings') {
-    return usageTooltipContent(palette.value, point.label, [
-      `缓存节省: ${formatUsd(point.cacheSavings)}`,
+    return usageTooltipContent(theme, point.label, [
+      usageTooltipItem(
+        '缓存节省',
+        formatUsd(costAmount(point.cacheSavings, pointIndex)),
+        theme.success,
+      ),
     ])
   }
 
   if (activeView.value === 'cache') {
-    return usageTooltipContent(palette.value, point.label, [
-      `缓存 Token 占比: ${formatPercent(point.cachedTokenRate)}`,
-      `命中请求率: ${formatPercent(point.cacheHitRequestRate)}`,
+    return usageTooltipContent(theme, point.label, [
+      usageTooltipItem('缓存 Token 占比', formatPercent(point.cachedTokenRate), theme.normal),
+      usageTooltipItem('命中请求率', formatPercent(point.cacheHitRequestRate), theme.success),
     ])
   }
 
   const lines = [
-    `实际费用: ${formatUsd(point.estimatedCost)}`,
+    usageTooltipItem(
+      '实际费用',
+      formatUsd(costAmount(point.estimatedCost, pointIndex)),
+      theme.success,
+    ),
   ]
-  if (point.noCacheCost != null)
-    lines.push(`无缓存费用: ${formatUsd(point.noCacheCost)}`)
-  return usageTooltipContent(palette.value, point.label, lines)
+  if (point.noCacheCost != null) {
+    lines.push(usageTooltipItem(
+      '无缓存费用',
+      formatUsd(costAmount(point.noCacheCost, pointIndex)),
+      theme.textMuted,
+    ))
+  }
+  return usageTooltipContent(theme, point.label, lines)
+}
+
+function costAmount(value: string | null, pointIndex: number) {
+  return value ?? (requestActivity.value[pointIndex] === false ? '0' : null)
 }
 </script>
 
@@ -196,7 +236,7 @@ function formatTooltip(params: unknown) {
     as="article"
     title="成本效率"
     description="实际费用、缓存节省、服务层溢价与单位成本"
-    class="h-full min-h-90"
+    class="min-h-90 xl:h-full"
   >
     <template #actions>
       <BaseSegmented v-model="activeView" label="成本视图" :options="viewOptions" :disabled="loading" class="w-50" />

frontend/src/views/usage/components/UsageHealthCard.vue

@@ -1,5 +1,5 @@
 <script setup lang="ts">
-import type { EChartsOption } from 'echarts'
+import type { BarSeriesOption, EChartsOption, LineSeriesOption } from 'echarts'
 import type { getUsageRecordInsightsOverview } from '@/api'
 import { BarChart } from 'echarts/charts'
 import { use } from 'echarts/core'
@@ -15,9 +15,11 @@ import {
   tooltipIndex,
   tooltipRows,
   usageCategoryAxis,
+  usageGapAwareLineSeries,
   usageLegend,
   usageTooltip,
   usageTooltipContent,
+  usageTooltipItem,
   usageValueAxis,
 } from '../utils/chart'
 import { formatPercent } from '../utils/format'
@@ -60,6 +62,26 @@ const chartOption = computed<EChartsOption>(() => {
   const theme = palette.value
   const chartPoints = points.value
   const activePointCount = chartPoints.filter(point => requestCount(point) > 0).length
+  const successRateSeries = usageGapAwareLineSeries(
+    '服务成功率',
+    chartPoints.map(serviceSuccessRate),
+    theme.success,
+    { yAxisIndex: 1 },
+  )
+  const series: Array<BarSeriesOption | LineSeriesOption> = [
+    outcomeSeries('成功', chartPoints.map(point => point.successRequests), theme.success),
+    outcomeSeries('服务失败', chartPoints.map(point => point.failedRequests), theme.danger),
+    outcomeSeries('取消', chartPoints.map(point => point.cancelledRequests), theme.info),
+    outcomeSeries('未完成', chartPoints.map(point => point.incompleteRequests), theme.warning),
+    outcomeSeries('调用方错误', chartPoints.map(point => point.callerErrorRequests), theme.normal),
+    ...successRateSeries.map((item, index) => index === 0
+      ? {
+          ...item,
+          symbol: activePointCount <= 16 ? 'circle' : 'none',
+          symbolSize: 4,
+        }
+      : item),
+  ]
 
   return {
     animationDuration: 240,
@@ -85,25 +107,7 @@ const chartOption = computed<EChartsOption>(() => {
         splitLine: false,
       }),
     ],
-    series: [
-      outcomeSeries('成功', chartPoints.map(point => point.successRequests), theme.success),
-      outcomeSeries('服务失败', chartPoints.map(point => point.failedRequests), theme.danger),
-      outcomeSeries('取消', chartPoints.map(point => point.cancelledRequests), theme.info),
-      outcomeSeries('未完成', chartPoints.map(point => point.incompleteRequests), theme.warning),
-      outcomeSeries('调用方错误', chartPoints.map(point => point.callerErrorRequests), theme.normal),
-      {
-        name: '服务成功率',
-        type: 'line',
-        yAxisIndex: 1,
-        data: chartPoints.map(serviceSuccessRate),
-        connectNulls: true,
-        smooth: 0.25,
-        symbol: activePointCount <= 16 ? 'circle' : 'none',
-        symbolSize: 4,
-        lineStyle: { color: theme.success, width: 2.2 },
-        itemStyle: { color: theme.success },
-      },
-    ],
+    series,
   }
 })
 
@@ -113,7 +117,9 @@ function requestCount(point: HealthPoint) {
 
 function serviceSuccessRate(point: HealthPoint) {
   const total = Math.max(0, point.successRequests) + Math.max(0, point.failedRequests)
-  return total > 0 ? Math.max(0, point.successRequests ?? 0) / total : null
+  if (total > 0)
+    return Math.max(0, point.successRequests ?? 0) / total
+  return requestCount(point) === 0 ? 0 : null
 }
 
 function outcomeSeries(name: string, data: number[], color: string) {
@@ -134,15 +140,20 @@ function formatTooltip(params: unknown) {
     return ''
 
   const successRate = serviceSuccessRate(point)
+  const theme = palette.value
 
-  return usageTooltipContent(palette.value, point.label, [
-    `请求量: ${formatCompactNumber(requestCount(point))}`,
-    `成功: ${formatCompactNumber(point.successRequests)}`,
-    `服务失败: ${formatCompactNumber(point.failedRequests)}`,
-    `取消: ${formatCompactNumber(point.cancelledRequests)}`,
-    `未完成: ${formatCompactNumber(point.incompleteRequests)}`,
-    `调用方错误: ${formatCompactNumber(point.callerErrorRequests)}`,
-    `服务成功率: ${successRate == null ? '无服务结果' : formatPercent(successRate)}`,
+  return usageTooltipContent(theme, point.label, [
+    usageTooltipItem('请求量', formatCompactNumber(requestCount(point)), theme.textSecondary),
+    usageTooltipItem('成功', formatCompactNumber(point.successRequests), theme.success),
+    usageTooltipItem('服务失败', formatCompactNumber(point.failedRequests), theme.danger),
+    usageTooltipItem('取消', formatCompactNumber(point.cancelledRequests), theme.info),
+    usageTooltipItem('未完成', formatCompactNumber(point.incompleteRequests), theme.warning),
+    usageTooltipItem('调用方错误', formatCompactNumber(point.callerErrorRequests), theme.normal),
+    usageTooltipItem(
+      '服务成功率',
+      successRate == null ? '无服务结果' : formatPercent(successRate),
+      theme.success,
+    ),
   ])
 }
 </script>
@@ -152,7 +163,7 @@ function formatTooltip(params: unknown) {
     as="article"
     title="请求健康"
     :description="`按${granularityText}区分服务结果、取消、未完成与调用方错误`"
-    class="h-full min-h-90"
+    class="min-h-90 xl:h-full"
   >
     <template #body>
       <div class="grid min-h-66" :class="hasData ? 'gap-3' : 'h-full'">

frontend/src/views/usage/components/UsageInsightsGrid.vue

@@ -28,7 +28,7 @@ const diagnosticDimension = defineModel('diagnosticDimension', {
 
 <template>
   <section
-    class="mt-5 grid grid-cols-1 gap-3 xl:auto-rows-[24.25rem] xl:grid-cols-2"
+    class="mt-5 grid grid-cols-1 gap-3 xl:auto-rows-97 xl:grid-cols-2"
     aria-label="使用统计观测"
   >
     <UsageHealthCard
@@ -43,8 +43,16 @@ const diagnosticDimension = defineModel('diagnosticDimension', {
       :loading="loading"
     />
 
-    <UsagePerformanceCard :performance="overview.performance" :loading="loading" />
+    <UsagePerformanceCard
+      :performance="overview.performance"
+      :activity="overview.health.points"
+      :loading="loading"
+    />
 
-    <UsageCostCard :cost="overview.cost" :loading="loading" />
+    <UsageCostCard
+      :cost="overview.cost"
+      :activity="overview.health.points"
+      :loading="loading"
+    />
   </section>
 </template>

frontend/src/views/usage/components/UsagePerformanceCard.vue

@@ -7,6 +7,7 @@ import BaseCard from '@/components/base/BaseCard.vue'
 import BaseEmpty from '@/components/base/BaseEmpty.vue'
 import BaseSegmented from '@/components/base/BaseSegmented.vue'
 import BaseChart from '@/components/charts/BaseChart.vue'
+import { requestActivityByBucket, zeroInactiveValues } from '@/components/charts/timeSeriesGap'
 import { useChartPalette } from '@/composables/useChartPalette'
 import { formatLocalizedCompactNumber as formatCompactNumber } from '@/utils/number'
 
@@ -14,20 +15,23 @@ import {
   tooltipIndex,
   tooltipRows,
   usageCategoryAxis,
+  usageGapAwareLineSeries,
   usageLegend,
-  usageLineSeries,
   usageTooltip,
   usageTooltipContent,
+  usageTooltipItem,
   usageValueAxis,
 } from '../utils/chart'
 import { formatDuration, formatDurationAxis, formatPercent } from '../utils/format'
 
 type Performance = Awaited<ReturnType<typeof getUsageRecordInsightsOverview>>['performance']
 type PerformancePoint = Performance['points'][number]
+type Activity = Awaited<ReturnType<typeof getUsageRecordInsightsOverview>>['health']['points']
 
 const props = withDefaults(
   defineProps<{
     performance: Performance
+    activity: Activity
     loading?: boolean
   }>(),
   {
@@ -38,6 +42,10 @@ const props = withDefaults(
 const activeView = shallowRef('total')
 const { palette } = useChartPalette()
 const performancePoints = computed<PerformancePoint[]>(() => props.performance.points)
+const requestActivity = computed(() => requestActivityByBucket(
+  performancePoints.value.map(point => point.bucket),
+  props.activity,
+))
 
 const viewOptions = [
   { label: '总耗时', value: 'total' },
@@ -54,14 +62,28 @@ const seriesLabels = computed(() => {
   return ['P50', 'P95', 'P99'] as const
 })
 
-const selectedPoints = computed(() =>
-  performancePoints.value.map(point => ({
+const selectedPoints = computed(() => {
+  const points = performancePoints.value
+  const active = requestActivity.value
+  const firstValues = zeroInactiveValues(
+    points.map(point => seriesValue(point, 'first')),
+    active,
+  )
+  const secondValues = zeroInactiveValues(
+    points.map(point => seriesValue(point, 'second')),
+    active,
+  )
+  const thirdValues = zeroInactiveValues(
+    points.map(point => seriesValue(point, 'third')),
+    active,
+  )
+  return points.map((point, index) => ({
     point,
-    first: seriesValue(point, 'first'),
-    second: seriesValue(point, 'second'),
-    third: seriesValue(point, 'third'),
-  })),
-)
+    first: firstValues[index] ?? null,
+    second: secondValues[index] ?? null,
+    third: thirdValues[index] ?? null,
+  }))
+})
 
 const summaryMetrics = computed(() => {
   const performance = props.performance
@@ -98,6 +120,25 @@ const hasData = computed(
 const chartOption = computed<EChartsOption>(() => {
   const theme = palette.value
   const points = selectedPoints.value
+  const series = [
+    ...usageGapAwareLineSeries(
+      seriesLabels.value[0],
+      points.map(point => point.first),
+      theme.info,
+      { area: 'subtle' },
+    ),
+    ...usageGapAwareLineSeries(
+      seriesLabels.value[1],
+      points.map(point => point.second),
+      theme.warning,
+    ),
+    ...usageGapAwareLineSeries(
+      seriesLabels.value[2],
+      points.map(point => point.third),
+      activeView.value === 'scheduling' ? theme.success : theme.danger,
+      { yAxisIndex: activeView.value === 'scheduling' ? 1 : 0 },
+    ),
+  ]
 
   return {
     animationDuration: 240,
@@ -130,27 +171,7 @@ const chartOption = computed<EChartsOption>(() => {
             ? value => `${formatCompactNumber(value)}/s`
             : formatDurationAxis,
         ),
-    series: [
-      usageLineSeries(
-        seriesLabels.value[0],
-        points.map(point => point.first),
-        theme.info,
-        { area: 'subtle' },
-      ),
-      usageLineSeries(
-        seriesLabels.value[1],
-        points.map(point => point.second),
-        theme.warning,
-      ),
-      {
-        ...usageLineSeries(
-          seriesLabels.value[2],
-          points.map(point => point.third),
-          activeView.value === 'scheduling' ? theme.success : theme.danger,
-        ),
-        yAxisIndex: activeView.value === 'scheduling' ? 1 : 0,
-      },
-    ],
+    series,
   }
 })
 
@@ -180,10 +201,23 @@ function formatTooltip(params: unknown) {
   if (!selected)
     return ''
 
-  return usageTooltipContent(palette.value, selected.point.label, [
-    `${seriesLabels.value[0]}: ${formatSeriesValue(selected.first, 'first')}`,
-    `${seriesLabels.value[1]}: ${formatSeriesValue(selected.second, 'second')}`,
-    `${seriesLabels.value[2]}: ${formatSeriesValue(selected.third, 'third')}`,
+  const theme = palette.value
+  return usageTooltipContent(theme, selected.point.label, [
+    usageTooltipItem(
+      seriesLabels.value[0],
+      formatSeriesValue(selected.first, 'first'),
+      theme.info,
+    ),
+    usageTooltipItem(
+      seriesLabels.value[1],
+      formatSeriesValue(selected.second, 'second'),
+      theme.warning,
+    ),
+    usageTooltipItem(
+      seriesLabels.value[2],
+      formatSeriesValue(selected.third, 'third'),
+      activeView.value === 'scheduling' ? theme.success : theme.danger,
+    ),
   ])
 }
 
@@ -205,7 +239,7 @@ function formatThroughput(value: number | null) {
     as="article"
     title="响应速度"
     description="延迟、吞吐与调度分位"
-    class="h-full min-h-90"
+    class="min-h-90 xl:h-full"
   >
     <template #actions>
       <BaseSegmented v-model="activeView" label="性能指标" :options="viewOptions" :disabled="loading" class="w-68" />

frontend/src/views/usage/constants.ts

@@ -35,15 +35,21 @@ export const usageRecordColumns = defineTableColumns<UsageDisplayRecord>([
 
 export const opsErrorColumns = defineTableColumns<OpsErrorRow>([
   { key: 'accountId', label: '账号', kind: 'mono', size: '3xl' },
-  { key: 'createdAtDisplay', label: '时间', kind: 'datetime' },
+  { key: 'provider', label: '平台/类型', kind: 'custom', size: 'sm' },
+  { key: 'message', label: '错误摘要', kind: 'custom', size: '3xl' },
+  { key: 'failureClass', label: '失败分类', kind: 'mono' },
   { key: 'upstreamStatusCode', label: '上游状态', kind: 'status', size: 'sm' },
   { key: 'clientStatusCode', label: '客户端状态', kind: 'status', size: 'md' },
-  { key: 'failureClass', label: '失败分类', kind: 'mono' },
-  { key: 'kind', label: '事件', kind: 'mono' },
+  { key: 'model', label: '模型', kind: 'custom', size: 'xl' },
+  { key: 'reasoningEffort', label: '推理强度', kind: 'custom' },
   { key: 'route', label: '端点', kind: 'mono' },
-  { key: 'model', label: '模型', kind: 'mono' },
+  { key: 'transport', label: '上游', kind: 'custom', size: 'md' },
+  { key: 'clientTransport', label: '接入', kind: 'custom', size: 'md' },
+  { key: 'createdAtDisplay', label: '时间', kind: 'datetime' },
   { key: 'requestId', label: '请求 ID', kind: 'mono', size: '2xl' },
-  { key: 'message', label: '错误摘要', kind: 'custom', size: '3xl' },
+  { key: 'kind', label: '事件', kind: 'mono' },
+  { key: 'clientIp', label: 'IP', kind: 'custom', size: '3xl' },
+  { key: 'userAgent', label: 'User-Agent', kind: 'custom', size: '4xl' },
   { key: 'actions', label: '操作', kind: 'actions', size: 'sm' },
 ])
 

frontend/src/views/usage/utils/chart.ts

@@ -1,5 +1,6 @@
 import type { LineSeriesOption } from 'echarts'
 import type { useChartPalette } from '@/composables/useChartPalette'
+import { sampleGapBridgeSeries } from '@/components/charts/timeSeriesGap'
 import { chartTooltipStyle } from '@/components/charts/tooltip'
 import { escapeTooltip } from './format'
 
@@ -9,6 +10,8 @@ type UsageAreaStrength = 'strong' | 'subtle'
 interface UsageLineSeriesOptions {
   stack?: string
   area?: UsageAreaStrength | false
+  xAxisIndex?: number
+  yAxisIndex?: number
 }
 
 const areaAlpha: Record<UsageAreaStrength, readonly [string, string]> = {
@@ -36,6 +39,8 @@ export function usageLineSeries(
     data: data.map(value => value ?? null),
     connectNulls: false,
     stack: options.stack,
+    xAxisIndex: options.xAxisIndex ?? 0,
+    yAxisIndex: options.yAxisIndex ?? 0,
     smooth: true,
     showSymbol: showSymbols,
     showAllSymbol: showSymbols,
@@ -61,6 +66,26 @@ export function usageLineSeries(
   }
 }
 
+export function usageGapAwareLineSeries(
+  name: string,
+  data: Array<number | null | undefined>,
+  color: string,
+  options: UsageLineSeriesOptions = {},
+) {
+  const primary = usageLineSeries(name, data, color, options)
+  return [
+    primary,
+    ...sampleGapBridgeSeries(data, {
+      name,
+      color,
+      xAxisIndex: options.xAxisIndex,
+      yAxisIndex: options.yAxisIndex,
+      width: 2.2,
+      z: 2,
+    }),
+  ]
+}
+
 export function usageTooltip(
   theme: UsageChartPalette,
   formatter: (params: unknown) => string,
@@ -81,6 +106,10 @@ export function usageTooltipContent(
   return `<div style="margin:0 0 7px;padding:0 0 7px;border-bottom:1px solid ${theme.divider};color:${theme.textPrimary};font-family:'JetBrains Mono Variable','JetBrains Mono',monospace;font-size:11px;font-weight:750;line-height:1.2">${title}</div><div style="line-height:1.55">${lines.join('<br/>')}</div>`
 }
 
+export function usageTooltipItem(label: string, value: string, color: string) {
+  return `<span style="display:inline-block;width:7px;height:7px;margin-right:6px;border-radius:999px;background:${escapeTooltip(color)}"></span>${escapeTooltip(label)}: ${escapeTooltip(value)}`
+}
+
 export function usageCategoryAxis(labels: string[], theme: UsageChartPalette) {
   return {
     type: 'category' as const,

release/version.yaml

@@ -1 +1 @@
-version: "3.3.11"
+version: "3.3.13"