aicodeswitch 5.1.2 → 5.2.0

package/dist/server/proxy-server.js

@@ -50,6 +50,7 @@ const axios_1 = __importDefault(require("axios"));
 const stream_1 = require("stream");
 const crypto_1 = __importDefault(require("crypto"));
 const streaming_1 = require("./transformers/streaming");
+const model_rewrite_transform_1 = require("./transformers/model-rewrite-transform");
 const chunk_collector_1 = require("./transformers/chunk-collector");
 const rules_status_service_1 = require("./rules-status-service");
 const index_1 = require("./conversions/index");
@@ -60,6 +61,8 @@ const type_migration_1 = require("./type-migration");
 const original_config_reader_1 = require("./original-config-reader");
 const compact_1 = require("./conversions/compact");
 const coding_plan_1 = require("./coding-plan");
+const coding_plan_headers_1 = require("./coding-plan-headers");
+const auth_1 = require("./auth");
 const SUPPORTED_TARGETS = ['claude-code', 'codex'];
 /** 默认模型列表 */
 const DEFAULT_MODELS = [
@@ -209,6 +212,12 @@ class ProxyServer {
             writable: true,
             value: void 0
         });
+        Object.defineProperty(this, "accessKeyModule", {
+            enumerable: true,
+            configurable: true,
+            writable: true,
+            value: null
+        });
         // 请求去重缓存：用于防止同一个请求被重复计数（如网络重试）
         // key: requestHash, value: timestamp
         Object.defineProperty(this, "requestDedupeCache", {
@@ -235,6 +244,73 @@ class ProxyServer {
         this.config = dbManager.getConfig();
         this.app = app;
     }
+    /** 设置 AccessKey 模块引用 */
+    setAccessKeyModule(module) {
+        this.accessKeyModule = module;
+    }
+    /** 获取 AccessKey 模块引用 */
+    getAccessKeyModule() {
+        return this.accessKeyModule;
+    }
+    /**
+     * 从请求中提取 API Key（支持三种 Header，按优先级依次尝试）
+     */
+    extractApiKey(req) {
+        const authHeader = req.headers.authorization;
+        if (authHeader) {
+            const key = authHeader.replace('Bearer ', '').trim();
+            if (key)
+                return key;
+        }
+        const xApiKey = req.headers['x-api-key'];
+        if (typeof xApiKey === 'string' && xApiKey.trim())
+            return xApiKey.trim();
+        const xGoogApiKey = req.headers['x-goog-api-key'];
+        if (typeof xGoogApiKey === 'string' && xGoogApiKey.trim())
+            return xGoogApiKey.trim();
+        return null;
+    }
+    /** 构建 AccessKey 相关的错误响应（匹配错误码格式） */
+    sendAccessKeyError(res, error, isClaudeFormat = false) {
+        res.setHeader('request-id', `req_ak_${Date.now()}`);
+        res.setHeader('connection', 'close');
+        if (isClaudeFormat) {
+            // Claude API 格式
+            res.status(error.httpStatus).json({
+                type: 'error',
+                error: {
+                    type: error.type,
+                    message: error.message,
+                }
+            });
+        }
+        else {
+            // OpenAI 格式
+            res.status(error.httpStatus).json({
+                error: {
+                    type: error.type,
+                    code: error.code,
+                    message: error.message,
+                }
+            });
+        }
+    }
+    /**
+     * 发送 AUTH 鉴权失败响应。
+     * 使用 511（Network Authentication Required）避免客户端将认证失败误判为官方 API 错误而持续重试。
+     * @param isClaudeFormat 是否使用 Claude API 错误格式（vs OpenAI 格式）
+     */
+    sendAuthError(res, isClaudeFormat) {
+        const message = 'Authentication required. Please provide a valid AccessKey.';
+        res.setHeader('request-id', `req_ak_${Date.now()}`);
+        res.setHeader('connection', 'close');
+        if (isClaudeFormat) {
+            res.status(511).json({ type: 'error', error: { type: 'api_error', message } });
+        }
+        else {
+            res.status(511).json({ error: { type: 'api_error', code: 'system_error', message } });
+        }
+    }
     inferTargetTypeFromPath(path) {
         if (path === '/claude-code' || path.startsWith('/claude-code/')) {
             return 'claude-code';
@@ -296,47 +372,161 @@ class ProxyServer {
             // /v1/models: 直接返回静态模型列表
             if (apiPath === '/v1/models') {
                 // 鉴权
-                if (this.config.apiKey) {
-                    const authHeader = req.headers.authorization;
-                    const providedKey = authHeader === null || authHeader === void 0 ? void 0 : authHeader.replace('Bearer ', '');
-                    if (!providedKey || providedKey !== this.config.apiKey) {
-                        res.status(401).json({ error: { message: 'Invalid API key' } });
+                const apiKeyValue = this.extractApiKey(req);
+                if (apiKeyValue === null || apiKeyValue === void 0 ? void 0 : apiKeyValue.startsWith('sk_')) {
+                    // AccessKey 鉴权
+                    if (!this.accessKeyModule) {
+                        res.status(401).json({ error: { type: 'authentication_error', code: 'INVALID_API_KEY', message: 'AccessKey 功能未启用' } });
                         return;
                     }
+                    const result = this.accessKeyModule.keyResolver.resolve(apiKeyValue);
+                    if (!result || 'error' in result) {
+                        const err = result ? result.error : { type: 'authentication_error', code: 'INVALID_API_KEY', message: '无效的 API Key', httpStatus: 401 };
+                        this.sendAccessKeyError(res, err);
+                        return;
+                    }
+                }
+                else if ((0, auth_1.isAuthEnabled)()) {
+                    // AUTH 已启用 → 仅允许 AccessKey 认证
+                    console.log(`\x1b[31m[AUTH] 511\x1b[0m ${req.method} ${req.path} — 未提供有效的 AccessKey`);
+                    this.sendAuthError(res, false);
+                    return;
                 }
                 res.json(buildModelsResponse(this.dbManager.getApiPathModels()));
                 return;
             }
             // 其余 4 个路径：查找绑定
-            const bindings = this.dbManager.getApiPathBindings();
-            const binding = bindings.find((b) => b.apiPath === apiPath);
-            if (!binding || !binding.routeId) {
-                res.status(404).json({ error: { message: `API path ${apiPath} is not bound to any route. Please configure it in Route Mapping settings.` } });
+            // 检查是否为 AccessKey 请求
+            const apiKeyValue = this.extractApiKey(req);
+            let accessKeyCtx = null;
+            if ((apiKeyValue === null || apiKeyValue === void 0 ? void 0 : apiKeyValue.startsWith('sk_')) && this.accessKeyModule) {
+                const result = this.accessKeyModule.keyResolver.resolve(apiKeyValue);
+                if (!result || 'error' in result) {
+                    const err = result ? result.error : { type: 'authentication_error', code: 'INVALID_API_KEY', message: '无效的 API Key', httpStatus: 401 };
+                    this.sendAccessKeyError(res, err, apiPathToClientFormat(apiPath) === 'claude');
+                    return;
+                }
+                accessKeyCtx = result;
+            }
+            else if ((0, auth_1.isAuthEnabled)()) {
+                // AUTH 已启用 → 仅允许 AccessKey 认证
+                console.log(`\x1b[31m[AUTH] 511\x1b[0m ${req.method} ${req.path} — 未提供有效的 AccessKey`);
+                this.sendAuthError(res, apiPathToClientFormat(apiPath) === 'claude');
                 return;
             }
-            // 加载绑定的路由
+            // 推断客户端格式
+            const clientFormat = apiPathToClientFormat(apiPath);
+            // 确定路由来源
             const allRoutes = this.dbManager.getRoutes();
-            const route = allRoutes.find((r) => r.id === binding.routeId);
+            let route;
+            if (accessKeyCtx) {
+                // AccessKey 请求：从策略的 routeId 获取路由
+                const policyRouteId = accessKeyCtx.policy.routeId;
+                if (policyRouteId && policyRouteId !== 'system') {
+                    // 策略绑定了具体路由
+                    route = allRoutes.find((r) => r.id === policyRouteId);
+                    if (!route) {
+                        this.sendAccessKeyError(res, { type: 'permission_error', code: 'NO_ROUTE_CONFIGURED', message: '策略绑定的路由不存在', httpStatus: 403 }, clientFormat === 'claude');
+                        return;
+                    }
+                }
+                else {
+                    // routeId 为空或 'system'：按系统默认路由
+                    const bindings = this.dbManager.getApiPathBindings();
+                    const binding = bindings.find((b) => b.apiPath === apiPath);
+                    if (!binding || !binding.routeId) {
+                        res.status(404).json({ error: { message: `API path ${apiPath} is not bound to any route. Please configure it in Route Mapping settings.` } });
+                        return;
+                    }
+                    route = allRoutes.find((r) => r.id === binding.routeId);
+                }
+            }
+            else {
+                // 正常请求：从 API 路径绑定获取路由
+                const bindings = this.dbManager.getApiPathBindings();
+                const binding = bindings.find((b) => b.apiPath === apiPath);
+                if (!binding || !binding.routeId) {
+                    res.status(404).json({ error: { message: `API path ${apiPath} is not bound to any route. Please configure it in Route Mapping settings.` } });
+                    return;
+                }
+                route = allRoutes.find((r) => r.id === binding.routeId);
+            }
+            // 会话级路由覆盖：仅对非 AccessKey 请求生效
+            if (!accessKeyCtx) {
+                const sessionId = this.extractSessionIdForFormat(req, clientFormat);
+                if (sessionId) {
+                    const session = this.dbManager.getSession(sessionId);
+                    if (session === null || session === void 0 ? void 0 : session.routeId) {
+                        const boundRoute = allRoutes.find((r) => r.id === session.routeId);
+                        if (boundRoute) {
+                            console.log(`[SESSION-ROUTE] API path ${apiPath} session ${sessionId} using bound route: ${boundRoute.name}`);
+                            route = boundRoute;
+                        }
+                        else {
+                            console.log(`[SESSION-ROUTE] Bound route ${session.routeId} not found for session ${sessionId}, clearing binding`);
+                            this.dbManager.unbindSessionRoute(sessionId).catch(console.error);
+                        }
+                    }
+                }
+            }
             if (!route) {
-                return res.status(404).json({ error: { message: `Bound route '${binding.routeId}' not found or inactive. Please check Route Mapping settings.` } });
+                return res.status(404).json({ error: { message: `Bound route not found or inactive.` } });
             }
-            // 推断客户端格式
-            const clientFormat = apiPathToClientFormat(apiPath);
             // 复用完整的代理请求处理
-            yield this.handleApiPathProxyRequest(req, res, route, clientFormat, apiPath);
+            yield this.handleApiPathProxyRequest(req, res, route, clientFormat, apiPath, accessKeyCtx);
         }));
         // Dynamic proxy middleware (原有的 /claude-code, /codex 逻辑)
         this.app.use((req, res, next) => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f;
             // 仅处理支持的目标路径
             if (!SUPPORTED_TARGETS.some(target => req.path.startsWith(`/${target}/`))) {
                 return next();
             }
+            // AUTH 鉴权检查
+            const apiKeyValue = this.extractApiKey(req);
+            if ((apiKeyValue === null || apiKeyValue === void 0 ? void 0 : apiKeyValue.startsWith('sk_')) && this.accessKeyModule) {
+                const result = this.accessKeyModule.keyResolver.resolve(apiKeyValue);
+                if (!result || 'error' in result) {
+                    const err = result ? result.error : { type: 'authentication_error', code: 'INVALID_API_KEY', message: '无效的 API Key', httpStatus: 401 };
+                    this.sendAccessKeyError(res, err, req.path.startsWith('/claude-code/'));
+                    return;
+                }
+                // 配额检查
+                const usage = yield this.accessKeyModule.usageTracker.getUsage(result.accessKey.id);
+                const quotaResult = this.accessKeyModule.quotaChecker.checkQuota(result.policy, usage, result.accessKey.id, (_a = req.body) === null || _a === void 0 ? void 0 : _a.model);
+                if (quotaResult) {
+                    this.sendAccessKeyError(res, { type: 'rate_limit_error', code: quotaResult.error, message: quotaResult.message, httpStatus: quotaResult.httpStatus }, req.path.startsWith('/claude-code/'));
+                    return;
+                }
+                this.accessKeyModule.quotaChecker.onRequestStart(result.accessKey.id, result.policy);
+                req._accessKeyCtx = result;
+            }
+            else if ((0, auth_1.isAuthEnabled)()) {
+                // AUTH 已启用 → 仅允许 AccessKey 认证
+                console.log(`\x1b[31m[AUTH] 511\x1b[0m ${req.method} ${req.path} — 未提供有效的 AccessKey`);
+                this.sendAuthError(res, req.path.startsWith('/claude-code/'));
+                return;
+            }
             const requestStartAt = Date.now();
             let hasRelayAttempt = false;
             try {
                 const pathTargetType = this.inferTargetTypeFromPath(req.path);
-                const route = this.findMatchingRoute(req);
+                // AccessKey 请求：从策略的 routeId 获取路由；否则从工具绑定获取
+                const accessKeyCtx = req._accessKeyCtx;
+                let route;
+                if ((accessKeyCtx === null || accessKeyCtx === void 0 ? void 0 : accessKeyCtx.policy.routeId) && accessKeyCtx.policy.routeId !== 'system') {
+                    // 策略绑定了具体路由
+                    route = this.dbManager.getRoutes().find((r) => r.id === accessKeyCtx.policy.routeId);
+                    if (!route) {
+                        this.accessKeyModule.quotaChecker.onRequestEnd(accessKeyCtx.accessKey.id);
+                        this.sendAccessKeyError(res, { type: 'permission_error', code: 'NO_ROUTE_CONFIGURED', message: '策略绑定的路由不存在', httpStatus: 403 }, req.path.startsWith('/claude-code/'));
+                        return;
+                    }
+                }
+                else {
+                    // routeId 为空或 'system'：按系统默认路由
+                    route = this.findMatchingRoute(req);
+                }
                 if (!route) {
                     // 没有找到激活的路由，尝试使用原始配置
                     const fallbackResult = yield this.handleFallbackToOriginalConfig(req, res, requestStartAt);
@@ -355,7 +545,7 @@ class ProxyServer {
                 }
                 // 高智商请求判定：存在规则时从消息末尾往前搜索 [!]/[x] 标记
                 const forcedContentType = yield this.prepareHighIqRouting(req, route, this.inferTargetTypeFromPath(req.path) || 'claude-code');
-                const enableFailover = ((_a = this.config) === null || _a === void 0 ? void 0 : _a.enableFailover) !== false; // 默认为 true
+                const enableFailover = ((_b = this.config) === null || _b === void 0 ? void 0 : _b.enableFailover) !== false; // 默认为 true
                 if (!enableFailover) {
                     // 故障切换已禁用,使用传统的单一规则匹配
                     const rule = yield this.findMatchingRule(route.id, req, forcedContentType);
@@ -438,7 +628,7 @@ class ProxyServer {
                         lastFailedService = service;
                         // 检测是否是 timeout 错误
                         const isTimeout = error.code === 'ECONNABORTED' ||
-                            ((_b = error.message) === null || _b === void 0 ? void 0 : _b.toLowerCase().includes('timeout')) ||
+                            ((_c = error.message) === null || _c === void 0 ? void 0 : _c.toLowerCase().includes('timeout')) ||
                             (error.errno && error.errno === 'ETIMEDOUT');
                         // 判断错误类型并加入黑名单
                         if (isTimeout) {
@@ -510,13 +700,13 @@ class ProxyServer {
                     requestBody: req.body ? JSON.stringify(req.body) : undefined,
                     // 添加请求详情
                     targetType,
-                    requestModel: (_c = req.body) === null || _c === void 0 ? void 0 : _c.model,
+                    requestModel: (_d = req.body) === null || _d === void 0 ? void 0 : _d.model,
                     responseTime: Date.now() - requestStartAt,
                     // 添加最后失败的服务信息
                     ruleId: lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.id,
                     targetServiceId: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.id,
                     targetServiceName: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.name,
-                    targetModel: (lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.targetModel) || ((_d = req.body) === null || _d === void 0 ? void 0 : _d.model),
+                    targetModel: (lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.targetModel) || ((_e = req.body) === null || _e === void 0 ? void 0 : _e.model),
                     vendorId: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.vendorId,
                     vendorName: _lastFailedVendor === null || _lastFailedVendor === void 0 ? void 0 : _lastFailedVendor.name,
                 });
@@ -544,29 +734,38 @@ class ProxyServer {
             }
             catch (error) {
                 console.error('Proxy error:', error);
-                yield this.logToolRequest(req, {
-                    statusCode: 500,
-                    responseTime: Date.now() - requestStartAt,
-                    targetType: this.inferTargetTypeFromPath(req.path),
-                    error: error.message,
-                    tags: this.buildRelayTags(hasRelayAttempt),
-                });
+                // AccessKey 错误处理：递减并发计数
+                const accessKeyCtx = req._accessKeyCtx;
+                if (accessKeyCtx && this.accessKeyModule) {
+                    this.accessKeyModule.quotaChecker.onRequestEnd(accessKeyCtx.accessKey.id);
+                    yield this.accessKeyModule.usageTracker.recordError(accessKeyCtx.accessKey.id);
+                }
+                else {
+                    yield this.logToolRequest(req, {
+                        statusCode: 500,
+                        responseTime: Date.now() - requestStartAt,
+                        targetType: this.inferTargetTypeFromPath(req.path),
+                        error: error.message,
+                        tags: this.buildRelayTags(hasRelayAttempt),
+                    });
+                }
                 // Add error log - 包含请求详情
-                const targetType = req.path.startsWith('/claude-code/') ? 'claude-code' : 'codex';
-                yield this.dbManager.addErrorLog({
-                    timestamp: Date.now(),
-                    method: req.method,
-                    path: req.path,
-                    statusCode: 500,
-                    errorMessage: error.message,
-                    errorStack: error.stack,
-                    requestHeaders: this.normalizeHeaders(req.headers),
-                    requestBody: req.body ? JSON.stringify(req.body) : undefined,
-                    // 添加请求详情
-                    targetType,
-                    requestModel: (_e = req.body) === null || _e === void 0 ? void 0 : _e.model,
-                    responseTime: Date.now() - requestStartAt,
-                });
+                if (!accessKeyCtx) {
+                    const targetType = req.path.startsWith('/claude-code/') ? 'claude-code' : 'codex';
+                    yield this.dbManager.addErrorLog({
+                        timestamp: Date.now(),
+                        method: req.method,
+                        path: req.path,
+                        statusCode: 500,
+                        errorMessage: error.message,
+                        errorStack: error.stack,
+                        requestHeaders: this.normalizeHeaders(req.headers),
+                        requestBody: req.body ? JSON.stringify(req.body) : undefined,
+                        targetType,
+                        requestModel: (_f = req.body) === null || _f === void 0 ? void 0 : _f.model,
+                        responseTime: Date.now() - requestStartAt,
+                    });
+                }
                 // 根据路径判断目标类型并返回适当的错误格式
                 const isClaudeCode = req.path.startsWith('/claude-code/');
                 if (this.isResponseCommitted(res)) {
@@ -597,26 +796,72 @@ class ProxyServer {
     }
     createFixedRouteHandler(targetType) {
         return (req, res) => __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e;
+            var _a, _b, _c, _d, _e, _f;
             const requestStartAt = Date.now();
             let hasRelayAttempt = false;
+            let accessKeyCtx = null;
             try {
-                // 检查API Key验证
-                if (this.config.apiKey) {
-                    const authHeader = req.headers.authorization;
-                    const providedKey = authHeader === null || authHeader === void 0 ? void 0 : authHeader.replace('Bearer ', '');
-                    if (!providedKey || providedKey !== this.config.apiKey) {
-                        yield this.logToolRequest(req, {
-                            statusCode: 401,
-                            responseTime: Date.now() - requestStartAt,
-                            targetType,
-                            error: 'Invalid API key',
-                            tags: this.buildRelayTags(false),
-                        });
-                        return res.status(401).json({ error: 'Invalid API key' });
+                // 检查 API Key 验证（支持 AccessKey 和全局 apiKey）
+                const apiKeyValue = this.extractApiKey(req);
+                if ((apiKeyValue === null || apiKeyValue === void 0 ? void 0 : apiKeyValue.startsWith('sk_')) && this.accessKeyModule) {
+                    // AccessKey 鉴权
+                    const result = this.accessKeyModule.keyResolver.resolve(apiKeyValue);
+                    if (!result || 'error' in result) {
+                        const err = result ? result.error : { type: 'authentication_error', code: 'INVALID_API_KEY', message: '无效的 API Key', httpStatus: 401 };
+                        this.sendAccessKeyError(res, err, targetType === 'claude-code');
+                        return;
+                    }
+                    accessKeyCtx = result;
+                    // 配额检查
+                    const model = (_a = req.body) === null || _a === void 0 ? void 0 : _a.model;
+                    const usage = yield this.accessKeyModule.usageTracker.getUsage(accessKeyCtx.accessKey.id);
+                    const quotaResult = this.accessKeyModule.quotaChecker.checkQuota(accessKeyCtx.policy, usage, accessKeyCtx.accessKey.id, model);
+                    if (quotaResult) {
+                        this.sendAccessKeyError(res, { type: 'rate_limit_error', code: quotaResult.error, message: quotaResult.message, httpStatus: quotaResult.httpStatus }, targetType === 'claude-code');
+                        return;
                     }
+                    // 并发 +1
+                    this.accessKeyModule.quotaChecker.onRequestStart(accessKeyCtx.accessKey.id, accessKeyCtx.policy);
+                }
+                else if ((0, auth_1.isAuthEnabled)()) {
+                    // AUTH 已启用 → 仅允许 AccessKey 认证
+                    console.log(`\x1b[31m[AUTH] 511\x1b[0m ${req.method} ${req.path} — 未提供有效的 AccessKey (targetType: ${targetType})`);
+                    yield this.logToolRequest(req, {
+                        statusCode: 511,
+                        responseTime: Date.now() - requestStartAt,
+                        targetType,
+                        error: 'Authentication required',
+                        tags: this.buildRelayTags(false),
+                    });
+                    this.sendAuthError(res, targetType === 'claude-code');
+                    return;
+                }
+                // 注入 AccessKey 上下文到请求对象，供 proxyRequest 内部的 finalizeLog 使用
+                if (accessKeyCtx) {
+                    req._accessKeyCtx = accessKeyCtx;
+                }
+                // 确定路由：AccessKey 请求从策略获取，否则从工具绑定获取
+                let route;
+                if (accessKeyCtx) {
+                    const policyRouteId = accessKeyCtx.policy.routeId;
+                    if (policyRouteId && policyRouteId !== 'system') {
+                        // 策略绑定了具体路由
+                        const allRoutes = this.dbManager.getRoutes();
+                        route = allRoutes.find((r) => r.id === policyRouteId);
+                        if (!route) {
+                            this.accessKeyModule.quotaChecker.onRequestEnd(accessKeyCtx.accessKey.id);
+                            this.sendAccessKeyError(res, { type: 'permission_error', code: 'NO_ROUTE_CONFIGURED', message: '策略绑定的路由不存在', httpStatus: 403 }, targetType === 'claude-code');
+                            return;
+                        }
+                    }
+                    else {
+                        // routeId 为空或 'system'：按系统默认路由
+                        route = this.findRouteByTargetType(targetType);
+                    }
+                }
+                else {
+                    route = this.findRouteByTargetType(targetType);
                 }
-                const route = this.findRouteByTargetType(targetType);
                 if (!route) {
                     yield this.logToolRequest(req, {
                         statusCode: 404,
@@ -630,7 +875,7 @@ class ProxyServer {
                 // 高智商请求判定：存在规则时从消息末尾往前搜索 [!]/[x] 标记
                 const forcedContentType = yield this.prepareHighIqRouting(req, route, targetType);
                 // 检查是否启用故障切换
-                const enableFailover = ((_a = this.config) === null || _a === void 0 ? void 0 : _a.enableFailover) !== false; // 默认为 true
+                const enableFailover = ((_b = this.config) === null || _b === void 0 ? void 0 : _b.enableFailover) !== false; // 默认为 true
                 if (!enableFailover) {
                     // 故障切换已禁用,使用传统的单一规则匹配
                     const rule = yield this.findMatchingRule(route.id, req, forcedContentType);
@@ -713,7 +958,7 @@ class ProxyServer {
                         lastFailedService = service;
                         // 检测是否是 timeout 错误
                         const isTimeout = error.code === 'ECONNABORTED' ||
-                            ((_b = error.message) === null || _b === void 0 ? void 0 : _b.toLowerCase().includes('timeout')) ||
+                            ((_c = error.message) === null || _c === void 0 ? void 0 : _c.toLowerCase().includes('timeout')) ||
                             (error.errno && error.errno === 'ETIMEDOUT');
                         // 判断错误类型并加入黑名单
                         if (isTimeout) {
@@ -783,13 +1028,13 @@ class ProxyServer {
                     requestBody: req.body ? JSON.stringify(req.body) : undefined,
                     // 添加请求详情
                     targetType,
-                    requestModel: (_c = req.body) === null || _c === void 0 ? void 0 : _c.model,
+                    requestModel: (_d = req.body) === null || _d === void 0 ? void 0 : _d.model,
                     responseTime: Date.now() - requestStartAt,
                     // 添加最后失败的服务信息
                     ruleId: lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.id,
                     targetServiceId: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.id,
                     targetServiceName: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.name,
-                    targetModel: (lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.targetModel) || ((_d = req.body) === null || _d === void 0 ? void 0 : _d.model),
+                    targetModel: (lastFailedRule === null || lastFailedRule === void 0 ? void 0 : lastFailedRule.targetModel) || ((_e = req.body) === null || _e === void 0 ? void 0 : _e.model),
                     vendorId: lastFailedService === null || lastFailedService === void 0 ? void 0 : lastFailedService.vendorId,
                     vendorName: _lastFailedVendor2 === null || _lastFailedVendor2 === void 0 ? void 0 : _lastFailedVendor2.name,
                 });
@@ -817,28 +1062,35 @@ class ProxyServer {
             }
             catch (error) {
                 console.error(`Fixed route error for ${targetType}:`, error);
-                yield this.logToolRequest(req, {
-                    statusCode: 500,
-                    responseTime: Date.now() - requestStartAt,
-                    targetType,
-                    error: error.message,
-                    tags: this.buildRelayTags(hasRelayAttempt),
-                });
-                // Add error log - 包含请求详情（使用函数参数 targetType）
-                yield this.dbManager.addErrorLog({
-                    timestamp: Date.now(),
-                    method: req.method,
-                    path: req.path,
-                    statusCode: 500,
-                    errorMessage: error.message,
-                    errorStack: error.stack,
-                    requestHeaders: this.normalizeHeaders(req.headers),
-                    requestBody: req.body ? JSON.stringify(req.body) : undefined,
-                    // 添加请求详情
-                    targetType,
-                    requestModel: (_e = req.body) === null || _e === void 0 ? void 0 : _e.model,
-                    responseTime: Date.now() - requestStartAt,
-                });
+                // AccessKey 错误处理：递减并发计数
+                const accessKeyCtx = req._accessKeyCtx;
+                if (accessKeyCtx && this.accessKeyModule) {
+                    this.accessKeyModule.quotaChecker.onRequestEnd(accessKeyCtx.accessKey.id);
+                    yield this.accessKeyModule.usageTracker.recordError(accessKeyCtx.accessKey.id);
+                }
+                else {
+                    yield this.logToolRequest(req, {
+                        statusCode: 500,
+                        responseTime: Date.now() - requestStartAt,
+                        targetType,
+                        error: error.message,
+                        tags: this.buildRelayTags(hasRelayAttempt),
+                    });
+                    // Add error log - 包含请求详情（使用函数参数 targetType）
+                    yield this.dbManager.addErrorLog({
+                        timestamp: Date.now(),
+                        method: req.method,
+                        path: req.path,
+                        statusCode: 500,
+                        errorMessage: error.message,
+                        errorStack: error.stack,
+                        requestHeaders: this.normalizeHeaders(req.headers),
+                        requestBody: req.body ? JSON.stringify(req.body) : undefined,
+                        targetType,
+                        requestModel: (_f = req.body) === null || _f === void 0 ? void 0 : _f.model,
+                        responseTime: Date.now() - requestStartAt,
+                    });
+                }
                 if (this.isResponseCommitted(res)) {
                     return;
                 }
@@ -872,6 +1124,24 @@ class ProxyServer {
         }
         if (!tool)
             return undefined;
+        // 优先检查会话级路由绑定
+        const sessionId = this.defaultExtractSessionId(req, tool);
+        if (sessionId) {
+            const session = this.dbManager.getSession(sessionId);
+            if (session === null || session === void 0 ? void 0 : session.routeId) {
+                const boundRoute = this.dbManager.getRoute(session.routeId);
+                if (boundRoute) {
+                    console.log(`[SESSION-ROUTE] Session ${sessionId} using bound route: ${boundRoute.name} (${boundRoute.id})`);
+                    return boundRoute;
+                }
+                else {
+                    // 路由已被删除，自动清除绑定
+                    console.log(`[SESSION-ROUTE] Bound route ${session.routeId} not found for session ${sessionId}, clearing binding`);
+                    this.dbManager.unbindSessionRoute(sessionId).catch(console.error);
+                }
+            }
+        }
+        // 回退到全局工具绑定
         const routeId = this.dbManager.getActiveRouteIdForTool(tool);
         if (!routeId)
             return undefined;
@@ -1040,7 +1310,9 @@ class ProxyServer {
                 const isBlacklisted = yield this.dbManager.isServiceBlacklisted(service.id, routeId, rule.contentType);
                 if (isBlacklisted)
                     continue;
-                return service.name;
+                const vendors = this.dbManager.getVendors();
+                const vendor = vendors.find(v => v.id === service.vendorId);
+                return vendor ? `${vendor.name}-${service.name}` : service.name;
             }
             return undefined;
         });
@@ -1049,7 +1321,7 @@ class ProxyServer {
         if (!forwardedToServiceName) {
             return '';
         }
-        return `；已自动转发给 ${forwardedToServiceName} 服务继续处理`;
+        return `；已自动转发给「${forwardedToServiceName}」服务继续处理`;
     }
     /**
      * 解析规则的有效超时时间（毫秒）。
@@ -1446,7 +1718,9 @@ class ProxyServer {
         const requestModel = body === null || body === void 0 ? void 0 : body.model;
         const candidates = [];
         const contentType = forcedContentType || this.determineContentType(req, this.inferTargetTypeFromPath(req.path) || 'claude-code', routeId);
-        const prioritizeContentType = contentType === 'high-iq';
+        // 所有特定内容类型（compact, thinking, long-context 等）优先于 model-mapping，
+        // 保持与 findMatchingRule 中的优先级顺序一致
+        const prioritizeContentType = contentType !== 'default';
         const modelMappingRules = requestModel
             ? enabledRules.filter(rule => rule.contentType === 'model-mapping' &&
                 rule.replacedModel &&
@@ -1591,6 +1865,9 @@ class ProxyServer {
         const sessionId = this.defaultExtractSessionId(req, targetType);
         for (const detector of this.getContentTypeDetectors()) {
             if (detector.match(req, body, sessionId, routeId)) {
+                if (detector.type === 'compact') {
+                    console.log('[CONTENT-TYPE] Detected compact request');
+                }
                 return detector.type;
             }
         }
@@ -2385,9 +2662,9 @@ class ProxyServer {
                 headers[key] = value.join(', ');
             }
         }
-        // 确定认证方式：优先使用服务配置的 authType
+        // 确定认证方式：优先使用服务配置的 authType，若继承供应商则使用供应商的 authType
         // 注意：向下兼容 'auto' 字符串值（前端已移除 AuthType.AUTO 枚举，但旧数据可能包含此值）
-        const authType = service.authType || types_1.AuthType.AUTH_TOKEN;
+        const authType = this.resolveEffectiveAuthType(service);
         // 向下兼容：检测旧数据的 'auto' 值
         // TODO: 删除
         const isAuto = authType === 'auto';
@@ -2427,6 +2704,10 @@ class ProxyServer {
             const bodyStr = JSON.stringify(requestBody);
             headers['content-length'] = Buffer.byteLength(bodyStr, 'utf8').toString();
         }
+        // 编程套餐 Headers 覆盖：当服务启用了编程套餐时，替换为编程工具的标准 Headers
+        if (service.enableCodingPlan) {
+            (0, coding_plan_headers_1.applyCodingPlanHeaders)(headers, sourceType);
+        }
         return headers;
     }
     resolveEffectiveApiKey(service) {
@@ -2451,6 +2732,17 @@ class ProxyServer {
         }
         return vendor.apiBaseUrl;
     }
+    resolveEffectiveAuthType(service) {
+        if (service.inheritVendorAuthType !== true) {
+            return service.authType || types_1.AuthType.AUTH_TOKEN;
+        }
+        const vendor = this.dbManager.getVendorByServiceId(service.id);
+        if (!vendor || !vendor.authType) {
+            console.warn(`[Proxy] Service ${service.id} is set to inherit vendor authType, but vendor/authType is missing`);
+            return service.authType || types_1.AuthType.AUTH_TOKEN;
+        }
+        return vendor.authType;
+    }
     copyResponseHeaders(responseHeaders, res) {
         Object.keys(responseHeaders).forEach((key) => {
             if (!['content-encoding', 'transfer-encoding', 'connection', 'content-length'].includes(key.toLowerCase())) {
@@ -2599,6 +2891,23 @@ class ProxyServer {
         }
         return rawUserId;
     }
+    /**
+     * 根据客户端格式提取 session ID（用于标准 API 路径的会话级路由覆盖）
+     */
+    extractSessionIdForFormat(request, format) {
+        var _a, _b;
+        if (format === 'claude') {
+            const rawUserId = (_b = (_a = request.body) === null || _a === void 0 ? void 0 : _a.metadata) === null || _b === void 0 ? void 0 : _b.user_id;
+            return ProxyServer.extractSessionIdFromUserId(rawUserId);
+        }
+        // 对于 completions/responses/gemini 格式，尝试从 headers 中提取
+        const sessionId = request.headers['session-id'] || request.headers['session_id'];
+        if (typeof sessionId === 'string')
+            return sessionId;
+        if (Array.isArray(sessionId))
+            return sessionId[0] || null;
+        return null;
+    }
     /**
      * 提取会话标题（默认方法）
      * 对于新会话，尝试从第一条消息的内容中提取标题
@@ -2685,6 +2994,7 @@ class ProxyServer {
     formatSessionTitle(text) {
         // 去除多余空白和换行符，替换为单个空格
         let formatted = text
+            .replace(/<\/?session>/g, '') // 移除 <session></session> 标签
             .replace(/\s+/g, ' ') // 多个空白字符替换为单个空格
             .replace(/[\r\n]+/g, ' ') // 换行符替换为空格
             .trim();
@@ -2883,7 +3193,7 @@ class ProxyServer {
     }
     proxyRequest(req, res, route, rule, service, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o;
+            var _a, _b, _c, _d, _e, _f, _g, _h, _j, _k, _l, _m, _o, _p, _q;
             res.locals.skipLog = true;
             const startTime = Date.now();
             const rawSourceType = service.sourceType || 'openai-chat';
@@ -3059,7 +3369,7 @@ class ProxyServer {
             // 标记规则正在使用
             rules_status_service_1.rulesStatusBroadcaster.markRuleInUse(route.id, rule.id);
             const finalizeLog = (statusCode, error) => __awaiter(this, void 0, void 0, function* () {
-                var _a, _b;
+                var _a, _b, _c, _d, _e, _f, _g;
                 if (logged)
                     return;
                 const isError = statusCode >= 400;
@@ -3075,11 +3385,109 @@ class ProxyServer {
                     return;
                 }
                 logged = true;
+                // ========== AccessKey 独立日志和统计 ==========
+                const accessKeyCtx = req._accessKeyCtx;
+                if (accessKeyCtx && this.accessKeyModule) {
+                    const { accessKey } = accessKeyCtx;
+                    try {
+                        // 写入 Key 独立日志
+                        yield this.accessKeyModule.keyLogger.addLog(accessKey.id, accessKey.name, {
+                            timestamp: Date.now(),
+                            method: req.method,
+                            path: req.originalUrl || req.path,
+                            headers: this.normalizeHeaders(req.headers),
+                            body: req.body,
+                            statusCode,
+                            responseTime: Date.now() - startTime,
+                            targetProvider: service.name,
+                            usage: usageForLog,
+                            error,
+                            contentType: rule.contentType,
+                            ruleId: rule.id,
+                            targetType,
+                            targetServiceId: service.id,
+                            targetServiceName: service.name,
+                            targetModel: rule.targetModel || ((_b = req.body) === null || _b === void 0 ? void 0 : _b.model),
+                            vendorId: service.vendorId,
+                            vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                            requestModel: (_c = req.body) === null || _c === void 0 ? void 0 : _c.model,
+                            tags: this.buildRelayTags(relayedForLog, useOriginalConfig),
+                            responseHeaders: responseHeadersForLog,
+                            responseBody: responseBodyForLog,
+                            streamChunks: streamChunksForLog,
+                            upstreamRequest: upstreamRequestForLog,
+                            downstreamResponseBody: downstreamResponseBodyForLog !== null && downstreamResponseBodyForLog !== void 0 ? downstreamResponseBodyForLog : responseBodyForLog,
+                        });
+                        // Token 回写
+                        if (usageForLog && statusCode < 400) {
+                            yield this.accessKeyModule.usageTracker.recordTokenUsage(accessKey.id, usageForLog);
+                        }
+                        else if (statusCode < 400) {
+                            yield this.accessKeyModule.usageTracker.recordRequest(accessKey.id);
+                        }
+                        // 错误记录
+                        if (statusCode >= 400) {
+                            yield this.accessKeyModule.usageTracker.recordError(accessKey.id);
+                        }
+                        // 密钥级会话追踪
+                        if (sessionId && sessionId !== '-' && statusCode < 400) {
+                            const sessionTokens = (usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.totalTokens) ||
+                                (((usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.inputTokens) || 0) + ((usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.outputTokens) || 0));
+                            const sessionTitle = this.defaultExtractSessionTitle(req, sessionId);
+                            this.accessKeyModule.keySessionTracker.upsertSession(accessKey.id, {
+                                id: sessionId,
+                                targetType,
+                                title: sessionTitle,
+                                firstRequestAt: startTime,
+                                lastRequestAt: Date.now(),
+                                vendorId: service.vendorId,
+                                vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                                serviceId: service.id,
+                                serviceName: service.name,
+                                model: rule.targetModel || ((_d = req.body) === null || _d === void 0 ? void 0 : _d.model),
+                                totalTokens: sessionTokens,
+                            }).catch(err => console.error('[KeySession] upsert error:', err));
+                        }
+                    }
+                    finally {
+                        // 并发 -1（无论成功失败）
+                        this.accessKeyModule.quotaChecker.onRequestEnd(accessKey.id);
+                    }
+                    // 同步全局统计数据（不写日志，仅更新统计）
+                    try {
+                        yield this.dbManager.syncStatisticsFromAccessKey({
+                            timestamp: Date.now(),
+                            method: req.method,
+                            path: req.originalUrl || req.path,
+                            headers: this.normalizeHeaders(req.headers),
+                            body: req.body,
+                            statusCode,
+                            responseTime: Date.now() - startTime,
+                            targetProvider: service.name,
+                            usage: usageForLog,
+                            error,
+                            contentType: rule.contentType,
+                            ruleId: rule.id,
+                            targetType,
+                            targetServiceId: service.id,
+                            targetServiceName: service.name,
+                            targetModel: rule.targetModel || ((_e = req.body) === null || _e === void 0 ? void 0 : _e.model),
+                            vendorId: service.vendorId,
+                            vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                            requestModel: (_f = req.body) === null || _f === void 0 ? void 0 : _f.model,
+                            tags: this.buildRelayTags(relayedForLog, useOriginalConfig),
+                        });
+                    }
+                    catch (statsErr) {
+                        console.error('[AccessKey] Failed to sync global statistics:', statsErr);
+                    }
+                    return; // ⛔ 跳过现有日志系统
+                }
                 // 供应商信息已在函数顶部获取
                 const vendors = this.dbManager.getVendors();
                 const vendorForLog = vendors.find(v => v.id === service.vendorId);
                 // 从请求体中提取模型信息
-                const requestModel = (_b = req.body) === null || _b === void 0 ? void 0 : _b.model;
+                const requestModel = (_g = req.body) === null || _g === void 0 ? void 0 : _g.model;
                 const tagsForLog = this.buildRelayTags(relayedForLog, useOriginalConfig);
                 if (extraTagsForLog.length > 0) {
                     tagsForLog.push(...extraTagsForLog);
@@ -3412,10 +3820,15 @@ class ProxyServer {
                     const parser = new streaming_1.SSEParserTransform();
                     const eventCollector = new chunk_collector_1.SSEEventCollectorTransform();
                     const serializer = new streaming_1.SSESerializerTransform();
-                    const downstreamChunkCollector = new chunk_collector_1.ChunkCollectorTransform();
+                    const downstreamChunkCollector = new chunk_collector_1.ChunkCollectorTransform(() => {
+                        rules_status_service_1.rulesStatusBroadcaster.refreshRuleInUse(route.id, rule.id);
+                    });
                     const compactResponseSanitizer = rule.contentType === 'compact' && targetType === 'claude-code'
                         ? new ClaudeCompactResponseSanitizer()
                         : null;
+                    // 流式 model 回写：将上游返回的 model 改写为客户端请求时的原始模型名
+                    const originalModel = (_d = req.body) === null || _d === void 0 ? void 0 : _d.model;
+                    const modelRewriter = originalModel ? new model_rewrite_transform_1.ModelRewriteTransform(originalModel) : null;
                     responseHeadersForLog = this.normalizeResponseHeaders(responseHeaders);
                     // 使用 transformSSEToTool 方法选择转换器
                     const { converter, extractUsage } = this.transformSSEToTool(targetType, sourceType);
@@ -3455,7 +3868,11 @@ class ProxyServer {
                                 if (compactResponseSanitizer) {
                                     streamStages.push(compactResponseSanitizer);
                                 }
-                                streamStages.push(serializer, downstreamChunkCollector, res);
+                                streamStages.push(serializer);
+                                if (modelRewriter) {
+                                    streamStages.push(modelRewriter);
+                                }
+                                streamStages.push(downstreamChunkCollector, res);
                                 (0, stream_1.pipeline)(streamStages[0], streamStages[1], streamStages[2], streamStages[3], ...streamStages.slice(4), (error) => {
                                     if (error) {
                                         reject(error);
@@ -3469,7 +3886,11 @@ class ProxyServer {
                             if (compactResponseSanitizer) {
                                 streamStages.push(compactResponseSanitizer);
                             }
-                            streamStages.push(serializer, downstreamChunkCollector, res);
+                            streamStages.push(serializer);
+                            if (modelRewriter) {
+                                streamStages.push(modelRewriter);
+                            }
+                            streamStages.push(downstreamChunkCollector, res);
                             (0, stream_1.pipeline)(streamStages[0], streamStages[1], streamStages[2], ...streamStages.slice(3), (error) => {
                                 if (error) {
                                     reject(error);
@@ -3506,10 +3927,10 @@ class ProxyServer {
                                 targetType,
                                 targetServiceId: service.id,
                                 targetServiceName: service.name,
-                                targetModel: rule.targetModel || ((_d = req.body) === null || _d === void 0 ? void 0 : _d.model),
+                                targetModel: rule.targetModel || ((_e = req.body) === null || _e === void 0 ? void 0 : _e.model),
                                 vendorId: service.vendorId,
                                 vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
-                                requestModel: (_e = req.body) === null || _e === void 0 ? void 0 : _e.model,
+                                requestModel: (_f = req.body) === null || _f === void 0 ? void 0 : _f.model,
                                 responseTime: Date.now() - startTime,
                             });
                         }
@@ -3553,10 +3974,10 @@ class ProxyServer {
                                 targetType,
                                 targetServiceId: service.id,
                                 targetServiceName: service.name,
-                                targetModel: rule.targetModel || ((_f = req.body) === null || _f === void 0 ? void 0 : _f.model),
+                                targetModel: rule.targetModel || ((_g = req.body) === null || _g === void 0 ? void 0 : _g.model),
                                 vendorId: service.vendorId,
                                 vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
-                                requestModel: (_g = req.body) === null || _g === void 0 ? void 0 : _g.model,
+                                requestModel: (_h = req.body) === null || _h === void 0 ? void 0 : _h.model,
                                 responseTime: Date.now() - startTime,
                             });
                         }
@@ -3575,7 +3996,7 @@ class ProxyServer {
                 let responseData = response.data;
                 if (streamRequested && response.data && typeof response.data.on === 'function' && !isEventStream) {
                     const raw = yield this.readStreamBody(response.data);
-                    responseData = (_h = this.safeJsonParse(raw)) !== null && _h !== void 0 ? _h : raw;
+                    responseData = (_j = this.safeJsonParse(raw)) !== null && _j !== void 0 ? _j : raw;
                 }
                 // 收集响应头
                 responseHeadersForLog = this.normalizeResponseHeaders(responseHeaders);
@@ -3596,6 +4017,10 @@ class ProxyServer {
                 // 提取 token usage（从原始响应数据中提取）
                 usageForLog = this.extractTokenUsageFromResponse(responseData, sourceType);
                 console.log('[Proxy] Non-stream response: extracted usageForLog:', usageForLog);
+                // 回写 model 字段：将上游返回的 model 改写为客户端请求时的原始模型名
+                const originalModel = (_k = req.body) === null || _k === void 0 ? void 0 : _k.model;
+                (0, model_rewrite_transform_1.rewriteResponseModel)(normalizedConverted, originalModel);
+                (0, model_rewrite_transform_1.rewriteResponseModel)(responseData, originalModel);
                 this.copyResponseHeaders(responseHeaders, res);
                 if (normalizedConverted && normalizedConverted !== responseData) {
                     // 非流式：responseBody 记录上游原始响应，downstreamResponseBody 记录转换后下发内容
@@ -3658,10 +4083,10 @@ class ProxyServer {
                         targetType,
                         targetServiceId: service.id,
                         targetServiceName: service.name,
-                        targetModel: rule.targetModel || ((_j = req.body) === null || _j === void 0 ? void 0 : _j.model),
+                        targetModel: rule.targetModel || ((_l = req.body) === null || _l === void 0 ? void 0 : _l.model),
                         vendorId: service.vendorId,
                         vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
-                        requestModel: (_k = req.body) === null || _k === void 0 ? void 0 : _k.model,
+                        requestModel: (_m = req.body) === null || _m === void 0 ? void 0 : _m.model,
                         upstreamRequest: upstreamRequestForLog,
                         responseTime: Date.now() - startTime,
                     });
@@ -3676,7 +4101,7 @@ class ProxyServer {
                 console.error('Proxy error:', error);
                 // 检测是否是 timeout 错误
                 const isTimeout = error.code === 'ECONNABORTED' ||
-                    ((_l = error.message) === null || _l === void 0 ? void 0 : _l.toLowerCase().includes('timeout')) ||
+                    ((_o = error.message) === null || _o === void 0 ? void 0 : _o.toLowerCase().includes('timeout')) ||
                     (error.errno && error.errno === 'ETIMEDOUT');
                 const statusCode = isTimeout ? 504 : this.getErrorStatusCode(error, 500);
                 const baseErrorMessage = isTimeout
@@ -3702,10 +4127,10 @@ class ProxyServer {
                     targetType,
                     targetServiceId: service.id,
                     targetServiceName: service.name,
-                    targetModel: rule.targetModel || ((_m = req.body) === null || _m === void 0 ? void 0 : _m.model),
+                    targetModel: rule.targetModel || ((_p = req.body) === null || _p === void 0 ? void 0 : _p.model),
                     vendorId: service.vendorId,
                     vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
-                    requestModel: (_o = req.body) === null || _o === void 0 ? void 0 : _o.model,
+                    requestModel: (_q = req.body) === null || _q === void 0 ? void 0 : _q.model,
                     upstreamRequest: upstreamRequestForLog,
                     responseHeaders: responseHeadersForLog,
                     responseTime: Date.now() - startTime,
@@ -3801,32 +4226,39 @@ class ProxyServer {
      * 处理通过标准 API 路径（/v1/messages, /v1/responses 等）进入的代理请求。
      * 与原有 proxyRequest 逻辑独立，复用规则匹配、故障切换等机制。
      */
-    handleApiPathProxyRequest(req, res, route, clientFormat, apiPath) {
+    handleApiPathProxyRequest(req, res, route, clientFormat, apiPath, accessKeyCtx) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b;
+            var _a, _b, _c;
             const requestStartAt = Date.now();
-            // 鉴权
-            if (this.config.apiKey) {
-                const authHeader = req.headers.authorization;
-                const providedKey = authHeader === null || authHeader === void 0 ? void 0 : authHeader.replace('Bearer ', '');
-                if (!providedKey || providedKey !== this.config.apiKey) {
+            // AccessKey 请求已在上层完成鉴权；非 AccessKey 请求在此鉴权
+            if (!accessKeyCtx) {
+                if ((0, auth_1.isAuthEnabled)()) {
+                    // AUTH 已启用 → 仅允许 AccessKey 认证
+                    console.log(`\x1b[31m[AUTH] 511\x1b[0m ${req.method} ${req.path} — 未提供有效的 AccessKey (apiPath: ${apiPath})`);
                     yield this.logToolRequest(req, {
-                        statusCode: 401,
+                        statusCode: 511,
                         responseTime: Date.now() - requestStartAt,
-                        error: 'Invalid API key',
+                        error: 'Authentication required',
                         tags: this.buildRelayTags(false),
                     });
-                    // 根据客户端格式返回错误
-                    if (clientFormat === 'claude') {
-                        res.status(401).json({ type: 'error', error: { type: 'authentication_error', message: 'Invalid API key' } });
-                    }
-                    else {
-                        res.status(401).json({ error: { message: 'Invalid API key' } });
-                    }
+                    this.sendAuthError(res, clientFormat === 'claude');
                     return;
                 }
             }
-            const enableFailover = ((_a = this.config) === null || _a === void 0 ? void 0 : _a.enableFailover) !== false;
+            if (accessKeyCtx) {
+                const model = (_a = req.body) === null || _a === void 0 ? void 0 : _a.model;
+                const usage = yield this.accessKeyModule.usageTracker.getUsage(accessKeyCtx.accessKey.id);
+                const quotaResult = this.accessKeyModule.quotaChecker.checkQuota(accessKeyCtx.policy, usage, accessKeyCtx.accessKey.id, model);
+                if (quotaResult) {
+                    this.sendAccessKeyError(res, { type: 'rate_limit_error', code: quotaResult.error, message: quotaResult.message, httpStatus: quotaResult.httpStatus }, clientFormat === 'claude');
+                    return;
+                }
+                // 并发 +1
+                this.accessKeyModule.quotaChecker.onRequestStart(accessKeyCtx.accessKey.id, accessKeyCtx.policy);
+                // 注入上下文到 req 对象，供 proxyRequestForApiPath 内部的 finalizeLog 使用
+                req._accessKeyCtx = accessKeyCtx;
+            }
+            const enableFailover = ((_b = this.config) === null || _b === void 0 ? void 0 : _b.enableFailover) !== false;
             if (!enableFailover) {
                 const rule = yield this.findMatchingRule(route.id, req);
                 if (!rule) {
@@ -3877,7 +4309,7 @@ class ProxyServer {
                     lastFailedRule = rule;
                     lastFailedService = service;
                     const isTimeout = error.code === 'ECONNABORTED' ||
-                        ((_b = error.message) === null || _b === void 0 ? void 0 : _b.toLowerCase().includes('timeout')) ||
+                        ((_c = error.message) === null || _c === void 0 ? void 0 : _c.toLowerCase().includes('timeout')) ||
                         error.errno === 'ETIMEDOUT';
                     if (isTimeout) {
                         yield this.dbManager.addToBlacklist(service.id, route.id, rule.contentType, 'Request timeout', undefined, 'timeout');
@@ -3920,7 +4352,7 @@ class ProxyServer {
      */
     proxyRequestForApiPath(req, res, route, rule, service, clientFormat, apiPath, options) {
         return __awaiter(this, void 0, void 0, function* () {
-            var _a, _b, _c, _d;
+            var _a, _b, _c, _d, _e, _f;
             const startTime = Date.now();
             const rawSourceType = service.sourceType || 'openai-chat';
             const sourceType = (0, type_migration_1.normalizeSourceType)(rawSourceType);
@@ -3959,9 +4391,93 @@ class ProxyServer {
                 requestBody = (0, compact_1.normalizeClaudeCompactRequestBody)(requestBody);
             }
             const finalizeLog = (statusCode, error) => __awaiter(this, void 0, void 0, function* () {
+                var _a, _b, _c, _d, _e;
                 if (logged)
                     return;
                 logged = true;
+                // AccessKey 独立日志处理
+                const accessKeyCtx = req._accessKeyCtx;
+                if (accessKeyCtx && this.accessKeyModule) {
+                    try {
+                        yield this.accessKeyModule.keyLogger.addLog(accessKeyCtx.accessKey.id, accessKeyCtx.accessKey.name, {
+                            timestamp: Date.now(),
+                            method: req.method,
+                            path: req.originalUrl || req.path,
+                            headers: this.normalizeHeaders(req.headers),
+                            body: req.body,
+                            statusCode,
+                            responseTime: Date.now() - startTime,
+                            usage: usageForLog,
+                            error,
+                            contentType: rule.contentType,
+                            ruleId: rule.id,
+                            targetServiceId: service.id,
+                            targetServiceName: service.name,
+                            targetModel: rule.targetModel || ((_a = req.body) === null || _a === void 0 ? void 0 : _a.model),
+                            vendorId: service.vendorId,
+                            vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                            requestModel: (_b = req.body) === null || _b === void 0 ? void 0 : _b.model,
+                            tags: this.buildRelayTags(relayedForLog),
+                        });
+                        if (usageForLog && statusCode < 400) {
+                            yield this.accessKeyModule.usageTracker.recordTokenUsage(accessKeyCtx.accessKey.id, usageForLog);
+                        }
+                        if (statusCode >= 400) {
+                            yield this.accessKeyModule.usageTracker.recordError(accessKeyCtx.accessKey.id);
+                        }
+                        // 密钥级会话追踪
+                        const apiSessionTargetType = clientFormat === 'claude' ? 'claude-code' : 'codex';
+                        const apiSessionId = this.extractSessionIdForFormat(req, clientFormat);
+                        if (apiSessionId && apiSessionId !== '-' && statusCode < 400) {
+                            const sessionTokens = (usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.totalTokens) ||
+                                (((usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.inputTokens) || 0) + ((usageForLog === null || usageForLog === void 0 ? void 0 : usageForLog.outputTokens) || 0));
+                            const sessionTitle = this.defaultExtractSessionTitle(req, apiSessionId);
+                            this.accessKeyModule.keySessionTracker.upsertSession(accessKeyCtx.accessKey.id, {
+                                id: apiSessionId,
+                                targetType: apiSessionTargetType,
+                                title: sessionTitle,
+                                firstRequestAt: startTime,
+                                lastRequestAt: Date.now(),
+                                vendorId: service.vendorId,
+                                vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                                serviceId: service.id,
+                                serviceName: service.name,
+                                model: rule.targetModel || ((_c = req.body) === null || _c === void 0 ? void 0 : _c.model),
+                                totalTokens: sessionTokens,
+                            }).catch(err => console.error('[KeySession] upsert error:', err));
+                        }
+                    }
+                    finally {
+                        this.accessKeyModule.quotaChecker.onRequestEnd(accessKeyCtx.accessKey.id);
+                    }
+                    // 同步全局统计数据（不写日志，仅更新统计）
+                    try {
+                        yield this.dbManager.syncStatisticsFromAccessKey({
+                            timestamp: Date.now(),
+                            method: req.method,
+                            path: req.originalUrl || req.path,
+                            headers: this.normalizeHeaders(req.headers),
+                            body: req.body,
+                            statusCode,
+                            responseTime: Date.now() - startTime,
+                            usage: usageForLog,
+                            error,
+                            contentType: rule.contentType,
+                            ruleId: rule.id,
+                            targetServiceId: service.id,
+                            targetServiceName: service.name,
+                            targetModel: rule.targetModel || ((_d = req.body) === null || _d === void 0 ? void 0 : _d.model),
+                            vendorId: service.vendorId,
+                            vendorName: vendor === null || vendor === void 0 ? void 0 : vendor.name,
+                            requestModel: (_e = req.body) === null || _e === void 0 ? void 0 : _e.model,
+                            tags: this.buildRelayTags(relayedForLog),
+                        });
+                    }
+                    catch (statsErr) {
+                        console.error('[AccessKey] Failed to sync global statistics:', statsErr);
+                    }
+                    return;
+                }
                 yield this.logToolRequest(req, {
                     statusCode,
                     responseTime: Date.now() - startTime,
@@ -4093,8 +4609,13 @@ class ProxyServer {
                     const parser = new streaming_1.SSEParserTransform();
                     const eventCollector = new chunk_collector_1.SSEEventCollectorTransform();
                     const serializer = new streaming_1.SSESerializerTransform();
-                    const downstreamChunkCollector = new chunk_collector_1.ChunkCollectorTransform();
+                    const downstreamChunkCollector = new chunk_collector_1.ChunkCollectorTransform(() => {
+                        rules_status_service_1.rulesStatusBroadcaster.refreshRuleInUse(route.id, rule.id);
+                    });
                     responseHeadersForLog = this.normalizeResponseHeaders(responseHeaders);
+                    // 流式 model 回写：将上游返回的 model 改写为客户端请求时的原始模型名
+                    const originalModel = (_d = req.body) === null || _d === void 0 ? void 0 : _d.model;
+                    const modelRewriter = originalModel ? new model_rewrite_transform_1.ModelRewriteTransform(originalModel) : null;
                     const { converter, extractUsage } = this.transformSSEByFormat(clientFormat, sourceType);
                     this.copyResponseHeaders(responseHeaders, res);
                     res.status(response.status);
@@ -4117,8 +4638,16 @@ class ProxyServer {
                     };
                     try {
                         yield new Promise((resolve, reject) => {
+                            const buildStages = (...upstream) => {
+                                const stages = [...upstream, serializer];
+                                if (modelRewriter)
+                                    stages.push(modelRewriter);
+                                stages.push(downstreamChunkCollector, res);
+                                return stages;
+                            };
                             if (converter) {
-                                (0, stream_1.pipeline)(response.data, parser, eventCollector, converter, serializer, downstreamChunkCollector, res, (error) => {
+                                const stages = buildStages(response.data, parser, eventCollector, converter);
+                                stream_1.pipeline(...stages, (error) => {
                                     if (error) {
                                         reject(error);
                                         return;
@@ -4127,7 +4656,8 @@ class ProxyServer {
                                 });
                             }
                             else {
-                                (0, stream_1.pipeline)(response.data, parser, eventCollector, serializer, downstreamChunkCollector, res, (error) => {
+                                const stages = buildStages(response.data, parser, eventCollector);
+                                stream_1.pipeline(...stages, (error) => {
                                     if (error) {
                                         reject(error);
                                         return;
@@ -4157,7 +4687,7 @@ class ProxyServer {
                 let responseData = response.data;
                 if (streamRequested && response.data && typeof response.data.on === 'function' && !isEventStream) {
                     const raw = yield this.readStreamBody(response.data);
-                    responseData = (_d = this.safeJsonParse(raw)) !== null && _d !== void 0 ? _d : raw;
+                    responseData = (_e = this.safeJsonParse(raw)) !== null && _e !== void 0 ? _e : raw;
                 }
                 responseHeadersForLog = this.normalizeResponseHeaders(responseHeaders);
                 if (this.isEmptyResponse(responseData)) {
@@ -4172,6 +4702,10 @@ class ProxyServer {
                     ? (0, compact_1.stripClaudeCompactResponseContent)(converted)
                     : converted;
                 usageForLog = this.extractTokenUsageFromResponse(responseData, sourceType);
+                // 回写 model 字段：将上游返回的 model 改写为客户端请求时的原始模型名
+                const originalModel = (_f = req.body) === null || _f === void 0 ? void 0 : _f.model;
+                (0, model_rewrite_transform_1.rewriteResponseModel)(normalizedConverted, originalModel);
+                (0, model_rewrite_transform_1.rewriteResponseModel)(responseData, originalModel);
                 this.copyResponseHeaders(responseHeaders, res);
                 if (normalizedConverted && normalizedConverted !== responseData) {
                     responseBodyForLog = typeof responseData === 'string' ? responseData : JSON.stringify(responseData);