feat(proxy): embed IP risk scoring and sync production line

.github/scripts/go-race-packages.sh

@@ -1,10 +1,8 @@
 #!/usr/bin/env bash
 # Print the `go test` selector args for one test-race shard so heavy packages
-# do not share a 2-core runner. The admin package alone takes ~12min under
-# -race on a 2-core runner (long tail of 1.5-5s tests, no single hot spot),
-# which collided with the 12m go-test timeout — so it is further split in two
-# by test-name initial (^Test[A-L] ≈ 45% of measured runtime, ^Test[^A-L] the
-# rest; the two regexes are complementary, no test can be silently skipped).
+# do not share a 2-core runner. Admin and database both have long tails under
+# -race, so each is split in two by test-name initial. The complementary
+# regexes cover every Test* function without silently skipping tests.
 # The `rest` shard is everything except the dedicated shards.
 set -euo pipefail
 
@@ -16,8 +14,11 @@ case "$shard" in
   admin-m-z)
     echo "-run ^Test[^A-L] ./admin"
     ;;
-  database)
-    echo ./database
+  database-a-l)
+    echo "-run ^Test[A-L] ./database"
+    ;;
+  database-m-z)
+    echo "-run ^Test[^A-L] ./database"
     ;;
   proxy)
     echo ./proxy/...

.github/workflows/pr-check.yml

@@ -104,7 +104,8 @@ jobs:
         include:
           - name: admin-a-l
           - name: admin-m-z
-          - name: database
+          - name: database-a-l
+          - name: database-m-z
           - name: proxy
           - name: promptfilter
           - name: rest

.gitignore

@@ -50,4 +50,8 @@ grok-build-main/
 .superpowers/
 CLAUDE.md
 .cursor
-diagrams/
+diagrams/
+# local run artifacts
+/data/
+/codex2api_local
+/server.log

DESIGN.md

@@ -0,0 +1,40 @@
+# DESIGN.md — 前端 UI 约束
+
+本文件是 `frontend/` 的组件与布局约束。所有前端改动（含 AI 代理生成的代码）必须遵守；
+`frontend/src/lib/uiConventions.test.mjs` 与 `claudeParity.test.mjs` 会在 CI 中强制其中可机检的部分。
+
+## 1. 表单控件：只用共享组件，不手写
+
+| 需求 | 必须使用 | 禁止 |
+|---|---|---|
+| 下拉选择 | `components/ui/select.tsx` 的 `Select`（`options` 数组，`value` / `onValueChange`） | 原生 `<select>` / 自定义 className 字符串（如 `selectCls`） |
+| 开关 | `components/ui/switch` 的 `Switch` | `<input type="checkbox">` |
+| 数字输入 | `components/ui/draft-number-input` 的 `DraftNumberInput`（带 `min` / `max`） | `<Input type="number">`（仅历史遗留允许） |
+| 文本输入 | `components/ui/input` 的 `Input` | 原生 `<input>` |
+| 少量互斥选项 | `Settings.tsx` 的 `SegmentedPillGroup` | 手写按钮组 |
+| 按钮 | `components/ui/button` 的 `Button`，图标用 lucide，加载态用 `RefreshCw` + `animate-spin` | 原生 `<button>` |
+
+需要新的表单控件时，先在 `components/ui/` 新增共享组件，再在页面使用；不在页面内部就地实现。
+
+## 2. 设置页布局
+
+- 每个配置模块用 `SettingsCard`（`title` / `description` / `icon` / `footer`）。
+- 单个配置项用 `SettingField`（`label` / `description` / `layout="switch"` 可选），说明性提示用 `SettingHelp`。
+- 栅格只用 `SETTINGS_FIELD_GRID` / `SETTINGS_FIELD_GRID_3` / `SETTINGS_SWITCH_GRID` 常量，不手写 `grid-cols-*`。
+- "开关 + 数值"成对的行（例如自动同步 + 间隔）沿用 Codex 运行时优化区块的两列边框布局；新增同类区块直接复制该结构。
+- 版本号、ID 等等宽内容用 `font-mono text-xs text-muted-foreground`。
+
+## 3. 文案
+
+- 所有可见文案走 `t('namespace.key')`；新增 key 必须同时写入 `locales/zh.json`、`en.json`、`zh-TW.json` 三个文件的同一位置。
+- 占位符用 `{{name}}`，不用字符串拼接。
+
+## 4. 守卫测试
+
+- 新增或改动设置区块时，在 `frontend/src/lib/claudeParity.test.mjs`（Claude 相关）或对应的源码守卫测试里加断言，覆盖：使用了哪个共享组件、调用了哪个 API 方法、i18n key 存在。
+- `uiConventions.test.mjs` 会扫描 `pages/` 与 `components/`（排除 `components/ui/select.tsx`）拒绝任何原生 `<select>`。
+
+## 5. 参照实现
+
+- 共享下拉：`frontend/src/pages/Settings.tsx` ClaudeCode 卡片的时区 / 指纹模式 / 平台 / 版本策略字段。
+- 同步按钮 + 自动同步开关 + 间隔：Settings.tsx 中 Codex "运行时优化" 与 ClaudeCode "CLI 版本同步" 区块。

admin/account_analysis.go

@@ -314,7 +314,7 @@ func buildAccountQuotaAnalysis(items []*accountListSnapshotItem, window string)
 	}
 	totalUsed := 0.0
 	for _, item := range items {
-		if item.Status == "unauthorized" || item.Status == "error" || item.OpenAIResponses || (window == "5h" && !accountListSubscriptionPlan(item.PlanType)) {
+		if item.Status == "unauthorized" || item.Status == "error" || item.OpenAIResponses || (window == "5h" && !accountList5hQuotaEligible(item)) {
 			continue
 		}
 		result.Total++
@@ -431,7 +431,7 @@ func buildAccountResetAnalysis(items []*accountListSnapshotItem, now time.Time)
 
 func accountRecoveryAt(item *accountListSnapshotItem, window string, now time.Time) (time.Time, bool) {
 	if window == "5h" {
-		if accountListSubscriptionPlan(item.PlanType) && item.UsagePercent5hOK && item.UsagePercent5h >= 100 && item.Reset5hAt.After(now) {
+		if accountList5hQuotaEligible(item) && item.UsagePercent5hOK && item.UsagePercent5h >= 100 && item.Reset5hAt.After(now) {
 			return item.Reset5hAt, false
 		}
 		if item.CooldownUntil.After(now) && accountAnalysisShortRateLimited(item) {
@@ -463,7 +463,7 @@ func accountAnalysisShortRateLimited(item *accountListSnapshotItem) bool {
 
 func accountAnalysisWindowRateLimited(item *accountListSnapshotItem, window string) bool {
 	if window == "5h" {
-		return (accountListSubscriptionPlan(item.PlanType) && item.UsagePercent5hOK && item.UsagePercent5h >= 100) || accountAnalysisShortRateLimited(item)
+		return (accountList5hQuotaEligible(item) && item.UsagePercent5hOK && item.UsagePercent5h >= 100) || accountAnalysisShortRateLimited(item)
 	}
 	status := strings.ToLower(item.Status)
 	reason := strings.ToLower(item.CooldownReason)
@@ -476,7 +476,7 @@ func accountAnalysisHasBurnPrediction(item *accountListSnapshotItem, window stri
 		return false
 	}
 	if window == "5h" {
-		return accountListSubscriptionPlan(item.PlanType) && item.UsagePercent5hOK
+		return accountList5hQuotaEligible(item) && item.UsagePercent5hOK
 	}
 	return true
 }

admin/account_groups.go

@@ -474,6 +474,9 @@ func accountRowGroupChannel(row *database.AccountRow) string {
 	if row != nil && strings.EqualFold(strings.TrimSpace(row.GetCredential("upstream_type")), auth.UpstreamAntigravity) {
 		return database.AccountGroupChannelAntigravity
 	}
+	if row != nil && strings.EqualFold(strings.TrimSpace(row.GetCredential("upstream_type")), auth.UpstreamClaude) {
+		return database.AccountGroupChannelClaude
+	}
 	if isGrokAccountRow(row) {
 		return database.AccountGroupChannelGrok
 	}
@@ -521,6 +524,8 @@ func groupChannelDisplayName(channel string) string {
 		return "Grok"
 	case database.AccountGroupChannelAntigravity:
 		return "Antigravity"
+	case database.AccountGroupChannelClaude:
+		return "Claude"
 	default:
 		return "Codex"
 	}

admin/account_response_builder.go

@@ -62,6 +62,7 @@ func (h *Handler) buildAccountResponse(
 	isOpenAIResponsesAccount := strings.EqualFold(upstreamType, auth.UpstreamOpenAIResponses)
 	isGrokAccount := strings.EqualFold(upstreamType, auth.UpstreamGrok)
 	isAntigravityAccount := strings.EqualFold(upstreamType, auth.UpstreamAntigravity)
+	isClaudeAccount := strings.EqualFold(upstreamType, auth.UpstreamClaude)
 	antigravityAuthKind := ""
 	if isAntigravityAccount {
 		if strings.TrimSpace(row.GetCredential("api_key")) != "" {
@@ -128,9 +129,39 @@ func (h *Handler) buildAccountResponse(
 	}
 	// 指纹收敛只作用于 Codex 官方出站路径，中转/Grok 账号不暴露该字段。
 	codexFingerprintMode := ""
-	if !isOpenAIResponsesAccount && !isGrokAccount && !isAntigravityAccount {
+	if !isOpenAIResponsesAccount && !isGrokAccount && !isAntigravityAccount && !isClaudeAccount {
 		codexFingerprintMode = auth.NormalizeCodexFingerprintMode(row.GetCredential(auth.CodexFingerprintModeCredentialKey))
 	}
+	// Claude Code 指纹收敛模式 + 绑定时区,仅 Claude OAuth 账号暴露。
+	claudeFingerprintMode := ""
+	accountTimezone := ""
+	claudeClientPlatformOverride := ""
+	claudeVersionPolicyOverride := ""
+	claudeClientVersionOverride := ""
+	claudeClientPolicy := auth.ClaudeClientPolicy{}
+	if strings.EqualFold(strings.TrimSpace(row.GetCredential("upstream_type")), auth.UpstreamClaude) {
+		claudeClientPolicy = auth.ClaudeClientPolicy{Platform: auth.ClaudeClientPlatformAny, VersionPolicy: auth.ClaudeVersionPolicyPassthrough}
+		claudeFingerprintMode = auth.NormalizeClaudeFingerprintMode(row.GetCredential(auth.ClaudeFingerprintModeCredentialKey))
+		accountTimezone = strings.TrimSpace(row.GetCredential("timezone"))
+		claudeClientPlatformOverride = strings.ToLower(strings.TrimSpace(row.GetCredential(auth.ClaudeClientPlatformCredentialKey)))
+		claudeVersionPolicyOverride = strings.ToLower(strings.TrimSpace(row.GetCredential(auth.ClaudeVersionPolicyCredentialKey)))
+		claudeClientVersionOverride = strings.TrimSpace(row.GetCredential(auth.ClaudeClientVersionCredentialKey))
+		if h.store != nil {
+			claudeClientPolicy = h.store.ClaudeClientPolicy()
+		}
+		if claudeClientPlatformOverride != "" {
+			claudeClientPolicy.Platform = auth.ClaudeClientPlatform(claudeClientPlatformOverride)
+		}
+		if claudeVersionPolicyOverride != "" {
+			claudeClientPolicy.VersionPolicy = auth.ClaudeVersionPolicy(claudeVersionPolicyOverride)
+		}
+		if claudeClientVersionOverride != "" {
+			claudeClientPolicy.ClientVersion = claudeClientVersionOverride
+		}
+		if normalized, err := auth.NormalizeClaudeClientPolicy(claudeClientPolicy); err == nil {
+			claudeClientPolicy = normalized
+		}
+	}
 	ignoreUsageLimitStatusOverride := row.GetCredentialOptionalBool("ignore_usage_limit_status_override")
 	ignoreUsageLimitStatusEffective := h.store.IgnoreUsageLimitStatus()
 	if ignoreUsageLimitStatusOverride != nil {
@@ -139,6 +170,7 @@ func (h *Handler) buildAccountResponse(
 	modelMapping := ""
 	var customHeaders map[string]string
 	var allowedAPIKeyIDs []int64
+	claudeUserAgent := ""
 	// 工作区 ID 不是密钥:Team/K12 徽章悬停要显示空间 ID。当前页
 	// ListActiveByIDs 已带完整凭据;custom_headers 只用来算生效空间,
 	// 摘要响应仍会剥掉原文。
@@ -148,66 +180,93 @@ func (h *Handler) buildAccountResponse(
 	effectiveWorkspaceID := openaiidentity.EffectiveWorkspaceID(tokenWorkspaceID, headers)
 	if includeDetails {
 		modelMapping = row.GetCredential("model_mapping")
-		customHeaders = headers
+		if isClaudeAccount {
+			// Claude detail responses may be consumed by admin tooling, but must
+			// never expose arbitrary historical custom headers such as
+			// Authorization/Cookie/x-api-key. Keep only the provider identity
+			// headers needed to inspect the stable fingerprint.
+			customHeaders = claudeExportFingerprintHeaders(headers)
+			for name, value := range customHeaders {
+				if strings.EqualFold(strings.TrimSpace(name), "user-agent") {
+					claudeUserAgent = strings.TrimSpace(value)
+					break
+				}
+			}
+		} else {
+			customHeaders = headers
+		}
 		allowedAPIKeyIDs = row.GetCredentialInt64Slice("allowed_api_key_ids")
 	}
 	resp := accountResponse{
-		DetailLoaded:             includeDetails,
-		ID:                       row.ID,
-		Name:                     row.Name,
-		Email:                    email,
-		EmailDomain:              accountEmailDomain(email),
-		ChatGPTAccountID:         row.GetCredential("account_id"),
-		TokenWorkspaceID:         tokenWorkspaceID,
-		WorkspaceIDOverride:      workspaceIDOverride,
-		EffectiveWorkspaceID:     effectiveWorkspaceID,
-		PlanType:                 planType,
-		SubscriptionExpiresAt:    row.GetCredential("subscription_expires_at"),
-		Status:                   row.Status,
-		ErrorMessage:             row.ErrorMessage,
-		ATOnly:                   !isOpenAIResponsesAccount && !isGrokAccount && !isAntigravityAccount && row.GetCredential("refresh_token") == "" && row.GetCredential("access_token") != "",
-		CreditEnabled:            row.CreditEnabled,
-		CreditSkipUsageWindow:    row.CreditSkipUsageWindow,
-		SkipWarmTier:             row.SkipWarmTier,
-		AccountType:              row.Type,
-		AccessTokenType:          accountAccessTokenType(row),
-		OpenAIResponsesAPI:       isOpenAIResponsesAccount,
-		GrokAPI:                  isGrokAccount,
-		AntigravityAPI:           isAntigravityAccount,
-		AntigravityAuthKind:      antigravityAuthKind,
-		AgentIdentity:            isAgentIdentityCredentialRow(row),
-		GrokAuthKind:             grokAuthKind,
-		GrokPlan:                 grokPlan,
-		GrokBilling:              grokBilling,
-		AvatarURL:                row.GetCredential("avatar_url"),
-		VerifiedEmail:            row.GetCredentialBool("verified_email"),
-		ProjectID:                row.GetCredential("project_id"),
-		AntigravityQuota:         antigravityQuota,
-		AntigravityPermissions:   antigravityPermissions,
-		AntigravitySyncWarning:   row.GetCredential("antigravity_sync_warning"),
-		BaseURL:                  baseURL,
-		BalanceQueryURL:          balanceQueryURL,
-		Models:                   row.GetCredentialStringSlice("models"),
-		ModelMapping:             modelMapping,
-		CodexClientMetadataMode:  codexClientMetadataMode,
-		CodexFingerprintMode:     codexFingerprintMode,
-		CustomHeaders:            customHeaders,
-		ProxyURL:                 row.ProxyURL,
-		Enabled:                  row.Enabled,
-		Locked:                   row.Locked,
-		AllowedAPIKeyIDs:         allowedAPIKeyIDs,
-		Tags:                     append([]string(nil), row.Tags...),
-		Note:                     row.Note,
-		ScoreBiasOverride:        nullableInt64Pointer(row.ScoreBiasOverride),
-		ScoreBiasEffective:       effectiveScoreBias(planType, row.ScoreBiasOverride),
-		BaseConcurrencyOverride:  nullableInt64Pointer(row.BaseConcurrencyOverride),
-		BaseConcurrencyEffective: effectiveBaseConcurrency(row.BaseConcurrencyOverride, int64(h.store.GetMaxConcurrency())),
-		CreatedAt:                row.CreatedAt.Format(time.RFC3339),
-		UpdatedAt:                row.UpdatedAt.Format(time.RFC3339),
-		CodexUsageUpdatedAt:      row.GetCredential("codex_usage_updated_at"),
-		Codex5HUsageUpdatedAt:    row.GetCredential("codex_5h_usage_updated_at"),
-		UsageLimitOverride:       ignoreUsageLimitStatusOverride,
-		UsageLimitEffective:      ignoreUsageLimitStatusEffective,
+		DetailLoaded:                 includeDetails,
+		ID:                           row.ID,
+		Name:                         row.Name,
+		Email:                        email,
+		EmailDomain:                  accountEmailDomain(email),
+		ChatGPTAccountID:             row.GetCredential("account_id"),
+		TokenWorkspaceID:             tokenWorkspaceID,
+		WorkspaceIDOverride:          workspaceIDOverride,
+		EffectiveWorkspaceID:         effectiveWorkspaceID,
+		PlanType:                     planType,
+		SubscriptionExpiresAt:        row.GetCredential("subscription_expires_at"),
+		Status:                       row.Status,
+		ErrorMessage:                 row.ErrorMessage,
+		ATOnly:                       !isOpenAIResponsesAccount && !isGrokAccount && !isAntigravityAccount && !isClaudeAccount && row.GetCredential("refresh_token") == "" && row.GetCredential("access_token") != "",
+		CreditEnabled:                row.CreditEnabled,
+		CreditSkipUsageWindow:        row.CreditSkipUsageWindow,
+		SkipWarmTier:                 row.SkipWarmTier,
+		AccountType:                  row.Type,
+		AccessTokenType:              accountAccessTokenType(row),
+		OpenAIResponsesAPI:           isOpenAIResponsesAccount,
+		GrokAPI:                      isGrokAccount,
+		AntigravityAPI:               isAntigravityAccount,
+		ClaudeAPI:                    isClaudeAccount,
+		AntigravityAuthKind:          antigravityAuthKind,
+		AgentIdentity:                isAgentIdentityCredentialRow(row),
+		GrokAuthKind:                 grokAuthKind,
+		GrokPlan:                     grokPlan,
+		GrokBilling:                  grokBilling,
+		AvatarURL:                    row.GetCredential("avatar_url"),
+		VerifiedEmail:                row.GetCredentialBool("verified_email"),
+		ProjectID:                    row.GetCredential("project_id"),
+		AntigravityQuota:             antigravityQuota,
+		AntigravityPermissions:       antigravityPermissions,
+		AntigravitySyncWarning:       row.GetCredential("antigravity_sync_warning"),
+		BaseURL:                      baseURL,
+		BalanceQueryURL:              balanceQueryURL,
+		Models:                       row.GetCredentialStringSlice("models"),
+		ModelMapping:                 modelMapping,
+		CodexClientMetadataMode:      codexClientMetadataMode,
+		CodexFingerprintMode:         codexFingerprintMode,
+		ClaudeFingerprintMode:        claudeFingerprintMode,
+		ClaudeUserAgent:              claudeUserAgent,
+		ClaudeClientPlatform:         string(claudeClientPolicy.Platform),
+		ClaudeVersionPolicy:          string(claudeClientPolicy.VersionPolicy),
+		ClaudeClientVersion:          claudeClientPolicy.ClientVersion,
+		ClaudeClientPlatformOverride: claudeClientPlatformOverride,
+		ClaudeVersionPolicyOverride:  claudeVersionPolicyOverride,
+		ClaudeClientVersionOverride:  claudeClientVersionOverride,
+		Timezone:                     accountTimezone,
+		CustomHeaders:                customHeaders,
+		ProxyURL:                     row.ProxyURL,
+		Enabled:                      row.Enabled,
+		Locked:                       row.Locked,
+		AllowedAPIKeyIDs:             allowedAPIKeyIDs,
+		Tags:                         append([]string(nil), row.Tags...),
+		Note:                         row.Note,
+		ScoreBiasOverride:            nullableInt64Pointer(row.ScoreBiasOverride),
+		ScoreBiasEffective:           effectiveScoreBias(planType, row.ScoreBiasOverride),
+		BaseConcurrencyOverride:      nullableInt64Pointer(row.BaseConcurrencyOverride),
+		BaseConcurrencyEffective:     effectiveBaseConcurrency(row.BaseConcurrencyOverride, int64(h.store.GetMaxConcurrency())),
+		CreatedAt:                    row.CreatedAt.Format(time.RFC3339),
+		UpdatedAt:                    row.UpdatedAt.Format(time.RFC3339),
+		CodexUsageUpdatedAt:          row.GetCredential("codex_usage_updated_at"),
+		Codex5HUsageUpdatedAt:        row.GetCredential("codex_5h_usage_updated_at"),
+		ClaudeUsageProbeAt:           row.GetCredential(auth.ClaudeUsageProbeAtCredentialKey),
+		ClaudeUsageProbeError:        row.GetCredential(auth.ClaudeUsageProbeErrorCredentialKey),
+		ClaudeUsageWindows:           parseClaudeUsageWindows(row.GetCredential(auth.ClaudeUsageWindowsCredentialKey)),
+		UsageLimitOverride:           ignoreUsageLimitStatusOverride,
+		UsageLimitEffective:          ignoreUsageLimitStatusEffective,
 	}
 	if isAntigravityAccount {
 		resp.Models = antigravityPublishedModelsOrDefault(row.GetCredentialStringSlice("models"))
@@ -407,6 +466,18 @@ func (h *Handler) buildAccountResponse(
 	return resp
 }
 
+func parseClaudeUsageWindows(raw string) []auth.ClaudeUsageWindow {
+	raw = strings.TrimSpace(raw)
+	if raw == "" {
+		return nil
+	}
+	var windows []auth.ClaudeUsageWindow
+	if err := json.Unmarshal([]byte(raw), &windows); err != nil {
+		return nil
+	}
+	return windows
+}
+
 func stripAccountDetailFields(resp *accountResponse) {
 	if resp == nil {
 		return