@lightharu/krouter 1.8.0 → 1.8.2

package/docs/CHANGELOG-v1.3.8.md

@@ -0,0 +1,128 @@
+# Kiro 账户管理器 v1.3.8 更新说明
+
+发布日期：2025-01-18
+
+## 🏢 IAM Identity Center SSO 登录
+
+### 新增组织身份登录
+- **登录入口**：添加账户对话框新增"组织身份"登录按钮
+- **SSO Start URL**：支持输入组织的 SSO Start URL 进行认证
+- **设备授权流程**：采用 AWS IAM Identity Center 设备授权流程
+
+### AWS Region 支持
+支持 20+ 个 AWS 区域，按地区分组：
+
+| 地区 | 支持的 Region |
+|------|--------------|
+| 美国 | us-east-1, us-east-2, us-west-1, us-west-2 |
+| 欧洲 | eu-west-1, eu-west-2, eu-west-3, eu-central-1, eu-north-1, eu-south-1 |
+| 亚太 | ap-northeast-1, ap-northeast-2, ap-northeast-3, ap-southeast-1, ap-southeast-2, ap-south-1, ap-east-1 |
+| 其他 | ca-central-1, sa-east-1, me-south-1, af-south-1 |
+
+## 🏷️ Enterprise Provider 支持
+
+### OIDC 凭证导入
+- **单个导入**：登录类型新增三个选项：Builder ID | 组织身份 | Social
+- **批量导入**：支持 `provider: "Enterprise"` 字段
+
+### 支持的 Provider 类型
+
+| Provider | 说明 | authMethod |
+|----------|------|------------|
+| `BuilderId` | AWS Builder ID | IdC |
+| `Enterprise` | 组织身份 (IAM SSO) | IdC |
+| `Google` | Google 登录 | social |
+| `Github` | GitHub 登录 | social |
+
+### 批量导入 JSON 示例
+```json
+[
+  {
+    "refreshToken": "xxx",
+    "clientId": "xxx",
+    "clientSecret": "xxx",
+    "provider": "BuilderId"
+  },
+  {
+    "refreshToken": "yyy",
+    "clientId": "yyy",
+    "clientSecret": "yyy",
+    "provider": "Enterprise"
+  },
+  {
+    "refreshToken": "zzz",
+    "provider": "Github"
+  },
+  {
+    "refreshToken": "aaa",
+    "provider": "Google"
+  }
+]
+```
+
+## 🔄 一键切号兼容性
+
+### 账户切换支持
+- 完全兼容 Enterprise 和 IAM_SSO 身份类型
+- 切换账户时正确传递 provider 信息
+
+## 📊 统计功能增强
+
+### 账户统计
+- `byIdp` 统计新增 `Enterprise` 和 `IAM_SSO` 类型
+- 账户卡片正确显示身份提供商标签
+
+## 📌 系统托盘增强
+
+### 托盘图标优化
+- **外部图标支持**：托盘菜单图标改用外部 PNG 文件，支持自定义替换
+- **图标缓存**：图标加载后缓存，提升菜单响应速度
+- **新增图标**：用量、请求数等信息现有专属图标
+
+### 托盘状态同步
+- **界面操作同步**：在软件界面启动/停止代理服务时，托盘状态实时同步更新
+
+### 关闭确认对话框
+- **自定义对话框**：关闭窗口时显示自定义确认对话框
+- **记住选择**：支持记住用户的关闭操作选择
+
+## 📝 代码变更
+
+### 类型定义 (account.ts)
+- `IdpType` 新增 `Enterprise` 和 `IAM_SSO`
+- `AccountCredentials.provider` 支持新类型
+
+### 主进程 (index.ts)
+- 新增 `start-iam-sso-login` IPC handler
+- 新增 `poll-iam-sso-auth` IPC handler
+- 新增 `cancel-iam-sso-login` IPC handler
+- `currentLoginState.type` 支持 `'iamsso'`
+
+### Preload API (index.ts, index.d.ts)
+- 新增 `startIamSsoLogin(startUrl, region)` 方法
+- 新增 `pollIamSsoAuth(region)` 方法
+- 新增 `cancelIamSsoLogin()` 方法
+
+### 添加账户对话框 (AddAccountDialog.tsx)
+- `LoginType` 新增 `'iamsso'`
+- 新增 SSO Start URL 输入框
+- 新增 AWS Region 下拉选择
+- 登录类型按钮：Builder ID | 组织身份 | Social
+- 批量导入 JSON 示例更新
+
+### 账户存储 (accounts.ts)
+- `byIdp` 统计支持 Enterprise 和 IAM_SSO
+
+---
+
+**完整更新列表**:
+- 🏢 IAM Identity Center SSO 登录
+- 🔗 SSO Start URL 输入
+- 🌍 20+ AWS Region 选择
+- 🏷️ Enterprise Provider 支持
+- 📦 批量导入增强
+- 🔄 一键切号兼容
+- 📊 统计功能增强
+- 📌 托盘图标优化
+- 🔄 托盘状态同步
+- 📝 关闭确认对话框

package/docs/images/api-proxy-client-setup.svg

@@ -0,0 +1,42 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-label="API key and client setup">
+  <rect width="1120" height="620" rx="28" fill="#f8fafc"/>
+  <text x="56" y="72" fill="#0f172a" font-family="Inter,Segoe UI,Arial" font-size="34" font-weight="800">Create Key And Connect Clients</text>
+  <text x="56" y="106" fill="#64748b" font-family="Inter,Segoe UI,Arial" font-size="17">Use one Krouter key for OpenClaw and OpenAI-compatible tools.</text>
+  <g font-family="Inter,Segoe UI,Arial">
+    <rect x="64" y="164" width="300" height="340" rx="22" fill="#ffffff" stroke="#cbd5e1"/>
+    <circle cx="108" cy="218" r="22" fill="#dbeafe"/>
+    <text x="96" y="226" fill="#2563eb" font-size="24" font-weight="800">1</text>
+    <text x="140" y="222" fill="#0f172a" font-size="21" font-weight="800">Create key</text>
+    <rect x="96" y="270" width="236" height="44" rx="12" fill="#0f172a"/>
+    <text x="116" y="298" fill="#dbeafe" font-size="15">sk-krouter-********</text>
+    <text x="96" y="356" fill="#475569" font-size="15">Dashboard -> API Proxy</text>
+    <text x="96" y="384" fill="#475569" font-size="15">Configure Clients</text>
+    <text x="96" y="412" fill="#475569" font-size="15">Create API Key</text>
+  </g>
+  <g font-family="Inter,Segoe UI,Arial">
+    <rect x="410" y="164" width="300" height="340" rx="22" fill="#ffffff" stroke="#cbd5e1"/>
+    <circle cx="454" cy="218" r="22" fill="#dcfce7"/>
+    <text x="442" y="226" fill="#16a34a" font-size="24" font-weight="800">2</text>
+    <text x="486" y="222" fill="#0f172a" font-size="21" font-weight="800">Set base URL</text>
+    <rect x="442" y="270" width="236" height="44" rx="12" fill="#ecfeff" stroke="#99f6e4"/>
+    <text x="462" y="298" fill="#0f766e" font-size="15">http://127.0.0.1:5580/v1</text>
+    <text x="442" y="356" fill="#475569" font-size="15">Provider: OpenAI compatible</text>
+    <text x="442" y="384" fill="#475569" font-size="15">Model: claude-sonnet-4.5</text>
+    <text x="442" y="412" fill="#475569" font-size="15">Header: Authorization Bearer</text>
+  </g>
+  <g font-family="Inter,Segoe UI,Arial">
+    <rect x="756" y="164" width="300" height="340" rx="22" fill="#ffffff" stroke="#cbd5e1"/>
+    <circle cx="800" cy="218" r="22" fill="#fef3c7"/>
+    <text x="788" y="226" fill="#d97706" font-size="24" font-weight="800">3</text>
+    <text x="832" y="222" fill="#0f172a" font-size="21" font-weight="800">Verify</text>
+    <rect x="788" y="270" width="224" height="44" rx="12" fill="#f0fdf4" stroke="#bbf7d0"/>
+    <text x="812" y="298" fill="#166534" font-size="15">GET /v1/models</text>
+    <text x="788" y="356" fill="#475569" font-size="15">Run /models in OpenClaw</text>
+    <text x="788" y="384" fill="#475569" font-size="15">Send a small chat test</text>
+    <text x="788" y="412" fill="#475569" font-size="15">Watch request logs</text>
+  </g>
+  <path d="M374 334 H398" stroke="#94a3b8" stroke-width="5" stroke-linecap="round"/>
+  <path d="M398 334 L388 324 M398 334 L388 344" stroke="#94a3b8" stroke-width="5" stroke-linecap="round"/>
+  <path d="M720 334 H744" stroke="#94a3b8" stroke-width="5" stroke-linecap="round"/>
+  <path d="M744 334 L734 324 M744 334 L734 344" stroke="#94a3b8" stroke-width="5" stroke-linecap="round"/>
+</svg>

package/docs/images/api-proxy-dashboard.svg

@@ -0,0 +1,37 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="620" viewBox="0 0 1120 620" role="img" aria-label="API Proxy dashboard settings">
+  <rect width="1120" height="620" rx="28" fill="#eaf1ff"/>
+  <rect x="56" y="48" width="1008" height="98" rx="24" fill="#ffffff" stroke="#cbd5e1"/>
+  <rect x="82" y="76" width="54" height="54" rx="16" fill="#3b82f6"/>
+  <text x="158" y="98" fill="#2563eb" font-family="Inter,Segoe UI,Arial" font-size="28" font-weight="800">API Proxy Service</text>
+  <text x="158" y="126" fill="#64748b" font-family="Inter,Segoe UI,Arial" font-size="16">OpenAI, Claude and Gemini compatible endpoint with multi-account rotation</text>
+  <rect x="56" y="176" width="1008" height="380" rx="24" fill="#ffffff" stroke="#cbd5e1"/>
+  <text x="88" y="220" fill="#0f172a" font-family="Inter,Segoe UI,Arial" font-size="21" font-weight="800">Recommended setup</text>
+  <g font-family="Inter,Segoe UI,Arial" font-size="16">
+    <text x="96" y="274" fill="#334155">Port</text>
+    <rect x="96" y="290" width="210" height="44" rx="12" fill="#f8fafc" stroke="#cbd5e1"/>
+    <text x="116" y="318" fill="#0f172a">5580</text>
+    <text x="342" y="274" fill="#334155">Host</text>
+    <rect x="342" y="290" width="260" height="44" rx="12" fill="#f8fafc" stroke="#cbd5e1"/>
+    <text x="362" y="318" fill="#0f172a">127.0.0.1</text>
+    <text x="638" y="274" fill="#334155">API Key</text>
+    <rect x="638" y="290" width="330" height="44" rx="12" fill="#f8fafc" stroke="#cbd5e1"/>
+    <text x="658" y="318" fill="#0f172a">sk-...</text>
+  </g>
+  <g font-family="Inter,Segoe UI,Arial" font-size="15" font-weight="700">
+    <rect x="96" y="370" width="128" height="38" rx="19" fill="#dbeafe"/>
+    <circle cx="118" cy="389" r="11" fill="#2563eb"/>
+    <text x="140" y="394" fill="#1e40af">Auto Start</text>
+    <rect x="252" y="370" width="168" height="38" rx="19" fill="#dcfce7"/>
+    <circle cx="274" cy="389" r="11" fill="#16a34a"/>
+    <text x="296" y="394" fill="#166534">Multi-Account</text>
+    <rect x="448" y="370" width="116" height="38" rx="19" fill="#fef3c7"/>
+    <text x="482" y="394" fill="#92400e">Smart</text>
+    <rect x="592" y="370" width="146" height="38" rx="19" fill="#ede9fe"/>
+    <circle cx="614" cy="389" r="11" fill="#7c3aed"/>
+    <text x="636" y="394" fill="#5b21b6">Log Requests</text>
+  </g>
+  <rect x="96" y="450" width="872" height="72" rx="18" fill="#f8fafc" stroke="#cbd5e1"/>
+  <text x="126" y="482" fill="#0f172a" font-family="Inter,Segoe UI,Arial" font-size="17" font-weight="800">Smart rotation</text>
+  <text x="126" y="510" fill="#475569" font-family="Inter,Segoe UI,Arial" font-size="15">Scores quota, errors, latency, request count and token freshness before selecting an account.</text>
+</svg>
+

package/docs/images/api-proxy-overview.svg

@@ -0,0 +1,51 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1120" height="520" viewBox="0 0 1120 520" role="img" aria-label="Krouter API Proxy overview">
+  <defs>
+    <linearGradient id="bg" x1="0" x2="1" y1="0" y2="1">
+      <stop offset="0" stop-color="#0f172a"/>
+      <stop offset="1" stop-color="#172554"/>
+    </linearGradient>
+    <linearGradient id="card" x1="0" x2="1">
+      <stop offset="0" stop-color="#1e293b"/>
+      <stop offset="1" stop-color="#111827"/>
+    </linearGradient>
+    <filter id="shadow" x="-20%" y="-20%" width="140%" height="140%">
+      <feDropShadow dx="0" dy="16" stdDeviation="18" flood-color="#020617" flood-opacity=".35"/>
+    </filter>
+  </defs>
+  <rect width="1120" height="520" rx="28" fill="url(#bg)"/>
+  <text x="56" y="72" fill="#f8fafc" font-family="Inter,Segoe UI,Arial" font-size="36" font-weight="800">Krouter API Proxy</text>
+  <text x="56" y="108" fill="#bfdbfe" font-family="Inter,Segoe UI,Arial" font-size="17">One endpoint for OpenAI, Claude, Gemini compatible AI tools</text>
+  <g filter="url(#shadow)">
+    <rect x="56" y="168" width="250" height="170" rx="18" fill="url(#card)" stroke="#334155"/>
+    <text x="84" y="214" fill="#e0f2fe" font-family="Inter,Segoe UI,Arial" font-size="22" font-weight="700">AI Clients</text>
+    <text x="84" y="252" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">OpenClaw / Aira</text>
+    <text x="84" y="282" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Codex-compatible tools</text>
+    <text x="84" y="312" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Cursor / Cline / custom apps</text>
+  </g>
+  <g filter="url(#shadow)">
+    <rect x="410" y="138" width="300" height="230" rx="22" fill="#0f766e" stroke="#5eead4"/>
+    <text x="448" y="194" fill="#ecfeff" font-family="Inter,Segoe UI,Arial" font-size="25" font-weight="800">Krouter Proxy</text>
+    <text x="448" y="236" fill="#ccfbf1" font-family="Inter,Segoe UI,Arial" font-size="16">/v1/chat/completions</text>
+    <text x="448" y="266" fill="#ccfbf1" font-family="Inter,Segoe UI,Arial" font-size="16">/v1/messages</text>
+    <text x="448" y="296" fill="#ccfbf1" font-family="Inter,Segoe UI,Arial" font-size="16">/v1beta/models/*</text>
+    <rect x="448" y="322" width="214" height="34" rx="17" fill="#134e4a"/>
+    <text x="472" y="344" fill="#99f6e4" font-family="Inter,Segoe UI,Arial" font-size="14" font-weight="700">Smart account rotation</text>
+  </g>
+  <g filter="url(#shadow)">
+    <rect x="816" y="140" width="248" height="228" rx="18" fill="url(#card)" stroke="#334155"/>
+    <text x="846" y="194" fill="#fef3c7" font-family="Inter,Segoe UI,Arial" font-size="22" font-weight="800">Kiro Accounts</text>
+    <text x="846" y="236" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Quota and plan checks</text>
+    <text x="846" y="266" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Token auto refresh</text>
+    <text x="846" y="296" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Profile ARN routing</text>
+    <text x="846" y="326" fill="#cbd5e1" font-family="Inter,Segoe UI,Arial" font-size="16">Model capability cache</text>
+  </g>
+  <path d="M318 253 H396" stroke="#93c5fd" stroke-width="5" stroke-linecap="round"/>
+  <path d="M386 239 L410 253 L386 267" fill="none" stroke="#93c5fd" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
+  <path d="M724 253 H800" stroke="#5eead4" stroke-width="5" stroke-linecap="round"/>
+  <path d="M790 239 L814 253 L790 267" fill="none" stroke="#5eead4" stroke-width="5" stroke-linecap="round" stroke-linejoin="round"/>
+  <text x="342" y="224" fill="#dbeafe" font-family="Inter,Segoe UI,Arial" font-size="14">Bearer sk-...</text>
+  <text x="742" y="224" fill="#ccfbf1" font-family="Inter,Segoe UI,Arial" font-size="14">Best account</text>
+  <rect x="56" y="422" width="1008" height="52" rx="16" fill="#020617" opacity=".45"/>
+  <text x="84" y="454" fill="#c7d2fe" font-family="Inter,Segoe UI,Arial" font-size="16">Recommended: local host 127.0.0.1, API key enabled, Multi-Account on, Strategy Smart, dashboard tunnel for VPS access.</text>
+</svg>
+

package/docs/web-port.md

@@ -0,0 +1,85 @@
+# Web Port Notes
+
+This branch starts the Electron-to-web port for the `v1.7.2` codebase.
+
+## Current Architecture
+
+- `vite.web.config.ts` builds the existing React renderer as a browser app.
+- `src/renderer/src/api/browserApi.ts` installs a browser `window.api` shim compatible with the Electron preload surface.
+- `src/server/index.ts` provides the CLI backend entry point:
+  - admin login/session cookies
+  - encrypted account data persistence
+  - generic `/api/ipc` bridge for renderer calls
+  - `/api/events` server-sent events bridge for realtime IPC-style events
+- `src/server/services/proxyRuntime.ts` runs the upstream reverse proxy on the VPS backend and wires proxy IPC handlers to the real `ProxyServer`.
+- `src/server/services/kproxyRuntime.ts` runs the upstream K-Proxy service on the VPS backend, including CA generation/export and device ID mapping.
+- `src/server/services/machineIdRuntime.ts` maps the Electron machine ID feature to the VPS host or to a configured machine-id file override.
+- `src/server/services/localKiroCredentials.ts` maps local Kiro IDE/CLI credential import, switch, and logout to VPS filesystem targets.
+- `src/server/services/protonBrowserRuntime.ts` maps the Electron Proton `BrowserWindow` flow to a server-side Chromium profile controlled through Chrome DevTools Protocol.
+
+## Deploy
+
+1. Copy `.env.web.example` to `.env.web`.
+2. Set strong values for `APP_ENCRYPTION_KEY` and `SESSION_SECRET`.
+   Leave `KROUTER_ADMIN_PASSWORD` unset to use the first-run setup screen, or set `KROUTER_ADMIN_EMAIL` and `KROUTER_ADMIN_PASSWORD` for unattended installs.
+3. Review the VPS filesystem targets:
+   - `KIRO_CONFIG_HOME` controls the Kiro settings/MCP/Steering directory.
+   - `KIRO_SSO_CACHE_DIR` controls the Kiro IDE SSO cache target.
+   - `KIRO_CLI_DB_PATH` controls the Kiro CLI SQLite database target.
+   - `KIRO_MACHINE_ID_FILE` is optional. Leave it unset to read/write the host OS machine ID; set it for Docker/test deployments where machine ID writes should stay isolated.
+   - `PUBLIC_BASE_URL` is used by legacy/manual OAuth callback helpers. Web IAM SSO uses the AWS device authorization flow because public OIDC clients only allow loopback redirect URIs.
+   - `PROTON_BROWSER_PATH` must point to Chrome/Chromium for the Proton OTP source. Dockerfile.web installs `/usr/bin/chromium`.
+   - `PROTON_BROWSER_HEADLESS=true` runs the server browser in headless mode and exposes `/proton-login` for remote login/captcha/2FA interaction.
+   - `PROTON_BROWSER_NO_SANDBOX=true` can be set when Chrome cannot start under a container or constrained desktop session. Docker/root deployments enable this automatically.
+4. Build and run the backend CLI:
+
+```bash
+npm run build:fullstack
+npm run start:backend
+```
+
+`start:backend` runs `node out-server/server/index.js --api-only`. In this mode the backend serves `/api/*`, `/api/events`, `/healthz`, and `/proton-login`, but it does not serve frontend assets. Put nginx or another static web server in front of it:
+
+```nginx
+root /path/to/Krouter/dist-web;
+
+location /api/ { proxy_pass http://127.0.0.1:4010; }
+location = /healthz { proxy_pass http://127.0.0.1:4010; }
+location = /proton-login { proxy_pass http://127.0.0.1:4010; }
+location / { try_files $uri /index.html; }
+```
+
+The old fullstack mode is still available with `node out-server/server/index.js --serve-static` or `SERVE_STATIC=true`.
+
+5. Docker fullstack deployment is still supported:
+
+```bash
+docker compose -f docker-compose.web.yml up -d --build
+```
+
+When deploying in Docker, filesystem-targeted features operate inside the container unless the matching host paths are bind-mounted. For example, host Kiro IDE/CLI switching requires mounting the host SSO cache or CLI database path into the container and pointing the env vars at the mounted paths.
+
+## Porting Queue
+
+The web foundation intentionally preserves the renderer API names, so Electron handlers can be ported one by one from `src/main/index.ts` and the split modules under `src/main`.
+
+Ported backend runtime areas:
+
+- Admin login/session and encrypted account store.
+- Account token refresh/check/verify via the VPS backend.
+- Kiro settings/MCP/Steering file management against `KIRO_CONFIG_HOME` or VPS `~/.kiro`.
+- Reverse proxy runtime, API keys, account pool sync, logs, models, metrics/status, TLS cert info.
+- K-Proxy runtime, CA generation/export, device ID mappings, status/start/stop.
+- Machine ID read/write, backup/restore, random generation, admin/root permission checks, and optional file override.
+- VPS-local Kiro IDE credential import/switch/logout against `KIRO_SSO_CACHE_DIR`.
+- VPS-local Kiro CLI credential switch against `KIRO_CLI_DB_PATH`, using `sqlite3` when installed or Node `node:sqlite` as fallback.
+- Account model list, subscription list, subscription URL, and overage preference handlers.
+- Builder ID, IAM SSO, social login, and SSO-token import handlers with web callback routes under `/api/auth/*/callback`.
+- Registration auto/manual handlers are wired to the upstream `Registrar` and emit logs/steps/completion through SSE.
+- Tingamefi temp mail can be used as an auto-registration source. It creates addresses through the Cloudflare Email Worker admin API (`/admin/new_address`) and reads verification mail through `/admin/mails`.
+- Proton mailbox login/OTP is wired to a VPS-side Chromium profile. Use the registration page's "Login Proton" action to open `/proton-login`, complete Proton login/captcha/2FA there, then run Proton or mixed-source registration. The remote login page supports screenshot refresh, click, scroll, text input, and basic keys against the server browser.
+- Background batch refresh/check and diagnostics/proxy-pool/account-liveness handlers.
+
+High-priority handlers still requiring full backend parity:
+
+- Production PostgreSQL migration from the current encrypted file store.

package/out-server/main/proxy/accountPool.js

@@ -64,7 +64,7 @@ class AccountPool {
     config;
     // 默认 round-robin: 选中账号时立即前进，避免并发请求集中到同一账号
     // sticky: 一个账号成功就粘住 (保留 prompt cache 命中)
-    strategy = 'round-robin';
+    strategy = 'smart';
     constructor(config = {}) {
         this.config = { ...DEFAULT_CONFIG, ...config };
     }
@@ -133,6 +133,9 @@ class AccountPool {
             return account;
         }
         const now = Date.now();
+        if (this.strategy === 'smart') {
+            return this.getSmartBalancedAccount(accountList, now, excludeIds);
+        }
         if (this.strategy === 'least-used') {
             return this.getLeastUsedAccount(accountList, now, excludeIds);
         }
@@ -173,6 +176,9 @@ class AccountPool {
         if (accountList.length === 0)
             return null;
         const now = Date.now();
+        if (this.strategy === 'smart') {
+            return this.getSmartBalancedAccount(accountList, now, excludeSet);
+        }
         if (this.strategy === 'least-used') {
             return this.getLeastUsedAccount(accountList, now, excludeSet);
         }
@@ -322,6 +328,74 @@ class AccountPool {
         }
         return best;
     }
+    getSmartBalancedAccount(accountList, now, excludeIds) {
+        let best = null;
+        for (const account of accountList) {
+            if (excludeIds?.has(account.id))
+                continue;
+            if (!this.isAccountAvailable(account, now))
+                continue;
+            const score = this.scoreAccountForSmartBalance(account, now);
+            if (!best ||
+                score > best.score ||
+                (score === best.score && (account.lastUsed || 0) < (best.account.lastUsed || 0))) {
+                best = { account, score };
+            }
+        }
+        if (best) {
+            this.accounts.set(best.account.id, { ...best.account, lastUsed: now });
+        }
+        return best?.account || null;
+    }
+    scoreAccountForSmartBalance(account, now) {
+        const stats = this.accountStats.get(account.id);
+        let score = 1000;
+        const quotaLimit = account.quotaLimit || 0;
+        if (quotaLimit > 0) {
+            const used = Math.max(0, account.quotaUsed || 0);
+            const remainingRatio = Math.max(0, Math.min(1, (quotaLimit - used) / quotaLimit));
+            score += remainingRatio * 500;
+            if (remainingRatio < 0.1)
+                score -= 300;
+            else if (remainingRatio < 0.2)
+                score -= 150;
+        }
+        else {
+            score += 100;
+        }
+        score -= Math.min(500, (account.errorCount || 0) * 140);
+        score -= Math.min(200, (stats?.errors || 0) * 25);
+        score -= Math.min(180, (account.requestCount || 0) * 3);
+        score -= Math.min(120, (stats?.requests || 0) * 2);
+        if (stats?.avgResponseTime) {
+            score -= Math.min(120, stats.avgResponseTime / 100);
+        }
+        const lastUsed = account.lastUsed || stats?.lastUsed || 0;
+        if (lastUsed > 0) {
+            const idleMs = now - lastUsed;
+            score += Math.min(120, Math.max(0, idleMs) / 1000 / 2);
+        }
+        else {
+            score += 120;
+        }
+        if (account.expiresAt) {
+            const minutesLeft = (account.expiresAt - now) / 60000;
+            if (minutesLeft < 5)
+                score -= 250;
+            else if (minutesLeft < 15)
+                score -= 80;
+        }
+        // Tiny deterministic jitter prevents permanent ties without defeating balance.
+        score += this.stableAccountJitter(account.id);
+        return score;
+    }
+    stableAccountJitter(accountId) {
+        let hash = 0;
+        for (let i = 0; i < accountId.length; i++) {
+            hash = ((hash << 5) - hash + accountId.charCodeAt(i)) | 0;
+        }
+        return Math.abs(hash % 17) / 10;
+    }
     // 记录请求成功（重置断路器 + 粘滞到当前账号）
     recordSuccess(accountId, tokens = 0) {
         const account = this.accounts.get(accountId);

package/out-server/main/proxy/proxyServer.js

@@ -270,13 +270,13 @@ class ProxyServer {
             tokenRefreshBeforeExpiry: 300, // 5分钟提前刷新
             autoStart: false, // 是否自动启动
             clientDrivenToolExecution: true,
-            accountSelectionStrategy: 'round-robin',
+            accountSelectionStrategy: 'smart',
             sessionAffinityEnabled: false,
             ...config
         };
         this.normalizeAccountBalancingConfig();
         this.accountPool = new accountPool_1.AccountPool();
-        this.accountPool.setStrategy(this.config.accountSelectionStrategy || 'round-robin');
+        this.accountPool.setStrategy(this.config.accountSelectionStrategy || 'smart');
         this.stats = {
             totalRequests: 0,
             successRequests: 0,
@@ -560,10 +560,10 @@ class ProxyServer {
         this.config = { ...this.config, ...config };
         this.normalizeAccountBalancingConfig();
         // 同步账号选择策略到 accountPool
-        this.accountPool.setStrategy(this.config.accountSelectionStrategy || 'round-robin');
+        this.accountPool.setStrategy(this.config.accountSelectionStrategy || 'smart');
     }
     normalizeAccountBalancingConfig() {
-        const strategy = this.config.accountSelectionStrategy || 'round-robin';
+        const strategy = this.config.accountSelectionStrategy || 'smart';
         this.config.accountSelectionStrategy = strategy;
         if (this.config.enableMultiAccount && strategy !== 'sticky') {
             this.config.sessionAffinityEnabled = false;
@@ -571,7 +571,7 @@ class ProxyServer {
     }
     isSessionAffinityActive() {
         return Boolean(this.config.sessionAffinityEnabled &&
-            (this.config.accountSelectionStrategy || 'round-robin') === 'sticky');
+            (this.config.accountSelectionStrategy || 'smart') === 'sticky');
     }
     /** UI 可用此判断是否需提示用户重启 */
     needsRestart() {

package/out-server/server/index.js

@@ -347,6 +347,18 @@ function accountNeedsBackendRefresh(account, now) {
     const expiresAt = Number(credentials.expiresAt || 0);
     return !credentials.accessToken || !expiresAt || expiresAt - now <= TOKEN_REFRESH_BEFORE_EXPIRY_MS;
 }
+function normalizeStoredUsagePercent(usage) {
+    const current = Number(usage.current);
+    const limit = Number(usage.limit);
+    if (Number.isFinite(current) && Number.isFinite(limit) && limit > 0) {
+        return { ...usage, percentUsed: current / limit };
+    }
+    const persisted = Number(usage.percentUsed);
+    if (Number.isFinite(persisted) && persisted > 1 && persisted <= 100) {
+        return { ...usage, percentUsed: persisted / 100 };
+    }
+    return usage;
+}
 function getStoredAccounts(accountData) {
     return isPlainRecord(accountData.accounts) ? accountData.accounts : {};
 }
@@ -366,7 +378,7 @@ function applyRefreshDataToStoredAccount(id, account, data, now) {
     let usage = account.usage;
     if (isPlainRecord(data?.usage)) {
         const currentUsage = isPlainRecord(account.usage) ? account.usage : {};
-        usage = { ...currentUsage, ...data.usage, lastUpdated: now };
+        usage = normalizeStoredUsagePercent({ ...currentUsage, ...data.usage, lastUpdated: now });
     }
     let subscription = account.subscription;
     if (isPlainRecord(data?.subscription)) {

package/out-server/server/services/kiroAccounts.js

@@ -418,7 +418,7 @@ async function checkAccountStatus(account) {
             profileArn: resolvedProfileArn,
             usage: {
                 ...normalized.usage,
-                percentUsed: normalized.usage.limit ? (normalized.usage.current / normalized.usage.limit) * 100 : 0,
+                percentUsed: normalized.usage.limit ? normalized.usage.current / normalized.usage.limit : 0,
                 lastUpdated: Date.now()
             },
             newCredentials: refreshResult?.data ? {

package/out-server/server/services/proxyRuntime.js

@@ -27,13 +27,13 @@ function defaultProxyConfig(saved) {
         retryDelayMs: 1000,
         tokenRefreshBeforeExpiry: 300,
         clientDrivenToolExecution: true,
-        accountSelectionStrategy: 'round-robin',
+        accountSelectionStrategy: 'smart',
         sessionAffinityEnabled: false,
         ...saved
     });
 }
 function normalizeProxyConfig(config) {
-    const strategy = config.accountSelectionStrategy || 'round-robin';
+    const strategy = config.accountSelectionStrategy || 'smart';
     const normalized = {
         ...config,
         accountSelectionStrategy: strategy