fix(usage): preserve account identity history (#7700)

* chore(ci): add .mergify.yml to main — Mergify only reads config from the default branch (#7168) * fix(ci): add the auto-enqueue pull_request_rule to the Mergify config (queue_conditions alone are eligibility-only) (#7179) * fix(ci): migrate Mergify auto-enqueue to merge_protections_settings.auto_merge_conditions (rules-based path is EOL 2026-07-16) (#7216) * fix(ci): drop Mergify batch settings (batching is a paid-tier feature; free plan queue is serial) (#7220) * fix(ci): merge queue tolerates the advisory dast-smoke failure (its GH-hosted build hang dequeued every attempt) (#7225) * test(ci): make the #6634 selfref guard hermetic — main's copy hard-fails every PR (#7341) main's copy of this test still does git I/O inside a unit test: const baseSrc = git(['show', 'origin/main:' + FILE]); Runners check out a shallow single ref, so origin/main does not resolve and the test dies with 'fatal: invalid object name origin/main'. Every PR into main fails Unit Tests (7/8) on it — today that is #7313, #7315, #7316, #7334, #7336 and #7337, six PRs red on a defect none of them introduced. #7313 has no other red at all. release/v3.8.49 already carries a fix (2e42b8efc, #7174: try/catch, fetch origin/main on demand, t.skip() when unreachable), but it only reaches main at release time — so main stays broken for the whole cycle. Cherry-picking it would also import a new problem: PR Test Policy classifies t.skip() as a silenced assertion, which we watched it correctly catch on #7300 today. This is the hermetic version instead (ported from #7327, which does the same for the release branch): read the file straight off disk, compare against an empty base so baseTaut/baseExtTaut are 0 — the strictest possible comparison point — and call evaluateMasking() directly. No git ref, no fetch, no skip, nothing the runner's checkout depth can break. The #6634 regression stays covered: the guard's logic lives in SELF_TEST_FIXTURE_RE (check-test-masking.mjs:337), not in the test. Proven both ways on main before committing — neutralise SELF_TEST_FIXTURE_RE to /$^/ and the test FAILS; restore it and it passes 2/2, with check-test-masking.mjs left byte-identical. Co-authored-by: growab <nekron@icloud.com> * chore(quality): tighten main's coverage baseline to the CI's real numbers (#7347) main's ratchet had been failing --require-tighten on every PR: 11 metrics improved but the baseline was never tightened. Same class as the #6634 selfref guard — an infra fix that lands only on the release branch leaves main red for the whole cycle, and every PR into main pays for it. Values are the merged-coverage numbers from a run on main itself (a local run measures ~68% vs CI's ~80%; the baseline's own note warns about that gap). Only the 11 coverage values change — gitleaks and semgrepFindings keep main's own state. No changelog fragment: #7326 carries it on release/v3.8.49, and a second one here would double the entry at release time. * Add cliproxy provider exposure controls and manifest injection (#7329) * feat(fusion): let judge use its own knowledge and override the panel (#6804) The judge prompt said to write an answer 'grounded in that analysis', implicitly capping output at the panel's union. When all panel members miss or are collectively wrong on something, the judge should apply its own reasoning as a full participant and override consensus, while keeping an honesty guard against fabrication. Adds a regression test. Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> * fix(api): raise provider apiKey cap for cookie-based web providers (#6715) (#6759) * fix(cli): fall back to settings.json when Claude Code binary is unresolvable (#6701) (#6734) getCliRuntimeStatus() only ever answered `installed` from binary resolution (known install paths + where/which PATH search), so a stale PATH, moved binary, or uncatalogued install method reported "not found" even when ~/.claude/settings.json proved the CLI was installed and used before — regressing behind upstream 9router's checkClaudeInstalled(), which already falls back to the settings file when where/which fails. withSettingsFallback() (new src/shared/services/cliInstallFallback.ts, kept out of the frozen cliRuntime.ts to respect its file-size ceiling) restores that parity: only when the binary lookup's own reason is "not_found" (never for deliberate security rejections like unsafe/relative env overrides or symlink escapes) and the tool's settings file exists on disk. * fix(providers): honor explicit thinking.budget_tokens 0 in openai->gemini transform (#6813) (#6821) The transform forwarded the Claude-style thinking.budget_tokens into generationConfig.thinkingConfig.thinkingBudget, but the presence check was truthy (&& thinking.budget_tokens). An explicit budget_tokens: 0 — the natural way to disable thinking — is falsy, so it was dropped and the request fell through to the default thinkingConfig injection, making the model think despite an explicit request for zero. Use an explicit numeric check so 0 is honored as thinkingBudget 0; includeThoughts is only set for a non-zero budget. * fix(compression): reconcile outer vs per-engine token counts (#6488) (#6741) * fix(compression): reconcile outer vs per-engine token counts on degenerate output (#6488) Outer originalTokens/compressedTokens (real tiktoken counter over extracted message text) diverged from engineBreakdown[0]'s counts (a crude JSON.stringify(requestBody).length/4 estimate), worst on small/degenerate inputs where JSON structural overhead dominates. A single-engine breakdown entry represents the exact same before/after transformation as the overall response, so reconcileSingleEngineTokens() now overwrites that one entry's counts with the outer, more accurate figures; multi-step pipeline breakdowns are left untouched. * chore(6741): resolve release sync — CHANGELOG.md restored to release tip, entry moved to changelog.d fragment (fragments-first) * fix(api): accept enableRenderers in RTK compression config schema (#6703) (#6757) * fix(db): break probe-failed/restore loop on large storage.sqlite (#6632) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(cursor): add Opus 4.8, Fable 5, and Sonnet 5 model families (#6779) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's cursor registry + test changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(translator): read PDF/video file attachments for Gemini/Antigravity and Claude (#6790) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's translator + test changes. Co-authored-by: Wital <witalorocha216@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(codex): strip include from compact responses requests (#6805) * fix(codex): strip include from compact responses requests Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(6805): move include-strip assertion to standalone test file to keep executor-codex.test.ts under frozen size cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(i18n): translate hardcoded Portuguese dashboard strings to English (#6769) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(bootstrap): filter empty process.env values to prevent Docker env crash loop (#6828) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); keeps only the author's bootstrap change. Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): update SenseNova Token Plan support (#6330) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's constants/registry/snapshot deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): classify 404 as MODEL_NOT_FOUND to stop retry storm (#6829) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); the author's chatCore/errorClassifier deltas were re-applied cleanly onto the release tip. Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(api): accept all catalog engines on compression PUT schema (#6792) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR). Resolved the release's OmniGlyph engine addition additively (types.ts/compression.ts kept both 'relevance' and 'omniglyph') and extended stackedPipelineStepSchema + STACKED_PIPELINE_ENGINE_INTENSITIES with the omniglyph branch so the ENGINE_CATALOG-parity test passes. Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(api): point CLI health command at /api/monitoring/health (#6677) (#6717) * fix(api): point CLI health command at /api/monitoring/health (#6677) bin/cli/commands/health.mjs called GET /api/health, a route that was moved to /api/monitoring/health without updating the CLI; the top-level /api/health handler never existed on disk (only degradation/ and ping/ sub-routes). Point runHealthCommand()/runHealthComponentsCommand() at /api/monitoring/health and read its real payload shape (activeConnections, circuitBreakers: {open,halfOpen,closed}, memoryUsage) instead of the old nonexistent requests/breakers/cache/memory fields. * chore(6717): re-sync onto release tip; move CHANGELOG entry to changelog.d fragment (fragments-first) * chore(cursor): add Grok 4.5 effort/fast model IDs (#6774) Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED (#6791) * fix(providers): ensure DeepSeek Web SSE emits [DONE] after FINISHED Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); keeps only the author's changes. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(deepseek): extract done-terminator helper to keep frozen file under cap Extracts the FINISHED-drain scheduler and finish-once guard added for the [DONE] terminator fix (#6777) into a new deepseek-web-done-terminator.ts module, so deepseek-web.ts stays under its frozen line cap (1148). Behavior is unchanged. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(models): add capability override UI (#6727) * feat(models): add capability override UI Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); renumbered the migration 118 -> 119 to resolve the collision with 118_provider_param_filters.sql already on release/v3.8.47; the author's i18n/localDb deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(6727): import model-capability-overrides DB fns directly (not via localDb barrel) to keep localDb under file-size cap; aligns with anti-barrel convention * chore(db): satisfy known-symbols contract for modelCapabilityOverrides Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(cursor): use Agent CLI build id for x-cursor-client-version (#6795) * fix(cursor): use Agent CLI build id for x-cursor-client-version Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's .env.example/docs deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip (restore #6701 bullet) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584) (#6718) * fix(startup): rename reasoningControls.ts to avoid webpack casing collision (#6584) * chore(6718): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582) (#6720) * fix(build): suppress Turbopack over-bundling warning from agentSkills generator (#6582) generator.ts builds outputBase from a non-literal outputDir parameter, so Turbopack's file-tracing analyzer can't narrow it and emits an "Overly broad patterns" warning per entry point that imports the module (603 warnings on v3.8.46, up from 379). The fs access is legitimate and bounded, so next.config.mjs now suppresses this specific diagnostic via turbopack.ignoreIssue, mirroring the existing webpack.ignoreWarnings precedent in the same file. * chore(6720): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651) (#6721) * fix(providers): drop image_generation for Codex Spark models regardless of plan (#6651) * chore(6721): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687) (#6722) * fix(providers): stop quota card re-sorting Codex/GLM bars by remaining % (#6687) QuotaCardExpanded.tsx unconditionally re-sorted quotas by remaining percentage via sortQuotasByRemaining(), discarding the deterministic CODEX_QUOTA_ORDER/GLM_QUOTA_ORDER window order quotaParsing.ts's sortCodexOrder()/sortGlmOrder() had already established. A new hasFixedQuotaOrder() + resolveQuotaDisplayOrder() skip the re-sort for providers with a fixed window order (codex, glm family), threading providerId from QuotaCard.tsx through to the display layer. Regression guard: tests/unit/quota-card-expanded-fixed-order-6687.test.ts * chore(6722): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559) (#6725) * fix(startup): lazy-import ioredis in rateLimiter to fix MCP ERR_MODULE_NOT_FOUND (#6559) * chore(6725): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(resilience): resolve fp-pinned combo account back to real connection id (#6696) (#6732) * fix(resilience): resolve fp-pinned combo account back to real connection id (#6696) * chore(6732): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561) (#6735) * fix(api): Responses passthrough emits event-only SSE frames after filtering commentary output (#6561) The #6199 commentary-drop `continue;` branches in stream.ts skipped the data: line for a dropped commentary event but never cleared the already-buffered event: line for the same frame, so the next blank line flushed the stale event: line alone -- an event-only SSE frame that crashes the OpenAI Python SDK's json.loads(). Both drop sites now call clearPendingPassthroughEvent() before continue. The commentary-drop decision was extracted into a new responsesCommentaryDrop.ts module so the fix does not grow the frozen stream.ts. * chore(6735): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(api): emit reasoning_content on claude-web + v0-vercel-web SSE (#6662) (#6743) * fix(api): emit reasoning_content on claude-web + v0-vercel-web /v1/chat/completions SSE (#6662) * chore(6743): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(sse): unwrap bare {function:{…}} tools in openai→claude translation (#6704) * fix(sse): unwrap bare {function:{…}} tools in openai→claude translation Some OpenAI-shape clients send a tool as a bare `{ function: {...} }` object, omitting the spec-required `type: "function"` parent wrapper. The tools-mapping in openai-to-claude.ts (~line 366) only unwrapped `tool.function` when `tool.type === "function"` was ALSO true, so a bare-function tool fell through to `toolData = tool` (the wrapper itself, with no `.name`), producing an empty `originalName` and silently dropping the tool from the translated request — worse than a 400, since the caller has no signal the tool never made it upstream. Unwrap `tool.function` whenever present, independent of the parent `type` field. Regression guard: tests/unit/openai-to-claude-bare-tool.test.ts. Co-authored-by: Samir Abis <me@samirabis.com> Inspired-by: https://github.com/decolua/9router/pull/2473 * chore(6704): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: Samir Abis <me@samirabis.com> * fix(oauth): avoid bare-email dedup of Codex OAuth logins (#6706) * fix(oauth): avoid bare-email dedup of Codex OAuth logins When an incoming Codex OAuth connection has no verifiable workspace/account id, do not merge it into an existing row on email match alone — that silently overwrote the other account's token pair. Require a matching chatgptUserId (a stable per-account JWT id) before merging; otherwise insert a distinct connection row. Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> Inspired-by: https://github.com/decolua/9router/pull/2477 * chore(6706): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> * fix(sse): skip thinkingConfig for gemma models in openai→gemini translation (#6708) open-sse/translator/request/claude-to-gemini.ts already guards against sending thinkingConfig for gemma-4-* models (Gemma doesn't support it — Vertex returns 400: "Thinking budget is not supported for this model"), but the OpenAI-shape path (openai-to-gemini.ts) lacked the same guard, so OpenAI-shape clients hitting a vertex gemma-4-* model still got a 400. Mirrors the existing claude-to-gemini.ts guard: wrap the reasoning_effort and Claude-shape thinking.budget_tokens branches with a model.startsWith ("gemma-4") check. Branch 3 (default includeThoughts for modern Gemini models) already excludes non-"gemini" model ids and needed no change. Inspired-by: https://github.com/decolua/9router/pull/2480 Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com> * fix(codex): surface capacity errors embedded in 200-OK SSE streams (#6710) * fix(codex): surface capacity errors embedded in 200-OK SSE streams Codex sometimes answers with HTTP 200 and a text/event-stream body whose payload carries a transient error mid-stream (e.g. "Selected model is at capacity...", server_is_overloaded, service_unavailable_error). Because the outer HTTP status was 200, this looked like a successful response to every caller — no retry, no circuit breaker, and no combo/account fallback ever engaged, so a healthy account sat idle while the request silently failed or truncated. Add peekCodexSseTransientError() to open-sse/executors/codex.ts: it peeks the first bytes of a text/event-stream Codex response, pattern-matches the known transient-error signatures, and converts a match into a real 503 Response via errorResponse() (Hard Rule #12 — sanitized, never raw upstream text). A 503 is already a recognized provider-failure status in accountFallback.ts, so combo routing and connection cooldown pick it up automatically. When no error signature is found, the peeked prefix is prepended back onto the remaining upstream body so the passthrough stays byte-identical to the unmodified response. Regression guard: tests/unit/codex-sse-capacity-fallback.test.ts — a model-at-capacity payload and a server_is_overloaded/service_unavailable_error payload both convert to 503; a normal single-chunk SSE stream and one split across multiple network chunks both reassemble byte-for-byte unchanged. Inspired-by: https://github.com/decolua/9router/pull/2452 (sub-bug #3 only — OmniRoute already covers PR #2452's other two sub-bugs: service_tier "fast" normalization and reasoning_effort "max" normalization). Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * chore(6710): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap (#6712) * fix(volcengine): clamp Kimi max_tokens to Ark endpoint cap VolcEngine Ark's Kimi coding-plan endpoint (ark.cn-beijing.volces.com) enforces max_tokens <= 32768 server-side and returns 400 "integer above maximum value, expected a value <= 32768" for anything over that ceiling. OmniRoute's StripRule only supported dropping params outright, with no numeric clamp mechanism, so a client sending a larger max_tokens (common default, e.g. 65536) 400s outright against volcengine's kimi-k2-5-260127. The 32768 cap is independently confirmed against two live-endpoint bug reports hitting this exact Ark endpoint for both kimi-k2.5 and kimi-k2.7-code (NousResearch/hermes-agent#51773, MoonshotAI/kimi-cli#1124), not just upstream's own value — same cap upstream 9router#2460 uses. StripRule gains two optional fields: `clampToModelMaxOutput` (clamp to the model's own catalog maxOutputTokens ceiling, when set) and `maxOutputCap` (a fixed endpoint-imposed ceiling); when both apply, the lower wins. The new rule is scoped to the literal id `kimi-k2-5-260127` (OmniRoute's real volcengine Kimi model, not upstream's `Kimi-K2.7-Code`), not a broad /kimi/i regex, so it can never clamp an unrelated future Kimi listing whose Ark cap may differ. glm-4-7-251222 (the other volcengine model) is unaffected. Inspired-by: https://github.com/decolua/9router/pull/2460 Co-authored-by: whale9820 <whale9820@users.noreply.github.com> * chore(6712): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: whale9820 <whale9820@users.noreply.github.com> * fix(antigravity): surface aborted Gemini tool calls off end_turn (#6713) * fix(antigravity): surface aborted Gemini tool calls off end_turn Gemini/Antigravity aborts a turn with finishReason MALFORMED_FUNCTION_CALL (or a sibling like UNEXPECTED_TOOL_CALL) instead of completing cleanly. Both Claude-facing translators collapsed these to a clean end_turn, hiding the aborted tool call as a successful completion: - the OpenAI hub path (openai-to-claude.ts convertFinishReason default), and - the DIRECT Gemini->Claude path (gemini-to-claude.ts), which is the one Claude Code actually hits through an antigravity/Gemini-routed model. Add isAbortFinishReason() to finishReason.ts and map these reasons to tool_use on both paths; genuinely unknown reasons still fall back to end_turn. Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> Inspired-by: https://github.com/decolua/9router/pull/2462 * chore(6713): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> * fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (#6729) * fix(translator): strip empty cloud_base_branch from Cursor Subagent tool call (port from 9router#2446) The Responses->Chat tool-arg cleanup (stripEmptyOptionalToolArgs) only stripped empty-string/empty-array optional args for Claude Code's Read tool. Cursor's local Subagent tool call therefore passed through with the cloud-only field cloud_base_branch: "", which Cursor rejects ("cloud_base_branch may only be specified when environment equals cloud") before starting the subagent. Extend the cleanup to an allowlist of Read + Subagent; arbitrary tools stay untouched. Reported-by: like3213934360-lab (https://github.com/decolua/9router/issues/2446) * chore(6729): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * fix(translator): defer content_block_start until GLM streams the tool name (#6730) * fix(translator): defer content_block_start until GLM streams the tool name (port from 9router#2077) GLM 5.2 (and similar OpenAI-compatible upstreams) stream a tool call's id and function.name across separate SSE delta chunks. The openai-to-claude streaming translator emitted content_block_start immediately on the id-only chunk with an empty name; the Claude SSE protocol cannot patch a block after emission, so the later name-only chunk was dropped and Claude Code rejected the tool_use with an empty tool name / "No such tool available:". Defer content_block_start until the name arrives (start on args if they arrive first), and emit a start for any orphaned id-only tool call at finish so content_block_stop is never orphaned. Reported-by: itiwant (https://github.com/decolua/9router/issues/2077) * chore(6730): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat(dashboard): add search to Playground model picker dropdown (#4086) (#6811) * feat(dashboard): add search to Playground model picker dropdown (#4086) The shared ModelSelectModal (combo builder + CLI-code cards) already had search, but the Playground's raw model <select> in StudioConfigPane stayed a flat unsearchable list - unusable once a provider like OpenRouter contributed 50+ models. Adds a search input above the dropdown that filters options via filterModelsByQuery() (Turkish-safe accent/case-insensitive match, reusing matchesSearch()). The currently selected model always stays pinned in the list even when it doesn't match the query, so typing never silently swaps the active selection. Reuses the existing common.search i18n key already translated in all 42 locales - no new key needed. * chore(6811): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat: request count log per provider, per date (#4009) (#6812) * feat(dashboard): request count log per provider, per date (#4009) Some providers bill by request rather than by token, so operators need a plain per-provider, per-date request count breakdown, not just token aggregates. Adds a new getProviderDailyUsageRows() aggregation query (src/lib/db/usageAnalytics.ts), a dedicated GET /api/usage/requests-by-provider-date route (kept separate from the frozen /api/usage/analytics route to respect the file-size baseline), and a sortable, single-date-filterable table on Dashboard -> Analytics. Closes #4009 * chore(6812): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) * feat(xai): route xAI clients to Grok native /v1/responses endpoint (#6709) * feat(xai): route xAI clients to Grok native /v1/responses endpoint xAI ships a native /v1/responses endpoint (https://api.x.ai/v1/responses) alongside /v1/chat/completions, but XaiExecutor extended BaseExecutor without overriding buildUrl(), so every request always resolved to the static chat-completions baseUrl regardless of target format — the last genuinely-missing slice of decolua/9router#2439 (grok-build-0.1, the reasoning-effort suffix routing, and bare grok-* routing were already ported in prior cycles). Add responsesBaseUrl to the xai registry entry and tag grok-4.20-multi-agent-0309 (upstream's own Responses-only id) with targetFormat: "openai-responses", mirroring the existing model-tag-driven routing pattern already used by the gh executor (9router#102) and the "openai" -pro heuristic in open-sse/executors/default.ts — the per-model registry tag is the single source of truth that also drives chatCore's body translation, so URL and body stay in lockstep. XaiExecutor.buildUrl now checks getModelTargetFormat("xai", model) and resolves to the native Responses endpoint only for tagged models, leaving every other grok-* model on the existing chat-completions bridge. TDD: tests/unit/executor-xai.test.ts adds a RED-then-GREEN case asserting grok-4.20-multi-agent-0309 resolves to https://api.x.ai/v1/responses and a control case asserting grok-4.3 still resolves to https://api.x.ai/v1/chat/completions. Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> Inspired-by: https://github.com/decolua/9router/pull/2439 * chore(6709): re-sync onto release tip; CHANGELOG → changelog.d fragment (fragments-first) --------- Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * fix(resilience): route remaining credential-selection call sites through quota preflight (#6686) (#6742) * fix(resilience): route remaining credential-selection call sites through quota preflight (#6686) * chore(6742): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638) (#6731) * fix(resilience): apikey-provider 429s honor explicit quota-exhausted text (#6638) Ollama Cloud (and any other apikey-category provider) 429s skipped body-text quota classification entirely; a genuine multi-day quota exhaustion was misclassified as a plain rate_limit_exceeded with a few seconds of cooldown, so combo routing retried the account immediately. shouldPreserveQuotaSignals() now lets an explicit quota-exhausted signal (looksLikeQuotaExhausted) override the apikey-category default, and parseDayGranularityResetMs() adds day- granularity reset-hint parsing ("...reset in 3 days.") alongside the existing Xh/Ym/Zs parsing. Regression guard: tests/unit/issue-6638-ollama-quota.test.ts (RED before the fix, GREEN after). Aligned two tests/unit/account-fallback-service.test.ts cases that had codified the old buggy behavior for apikey-provider quota text. * chore(6731): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709) (#6817) * feat(resilience): weekly-429 cooldown for fetcher-less providers (#3709) Ollama Cloud free-tier accounts have a hard WEEKLY request cap. On cap the upstream returns 429 "you (<account>) have reached your weekly usage limit", but ollama-cloud is an apikey-category provider, so the existing oauth-only shouldUseQuotaSignal gate in checkFallbackError skips the subscription-quota-text classifier (Issue #2321) for its 429s -- the account fell through to the generic exponential backoff (~1s, capped at 2min) and got retried every few minutes for the rest of the week (one account took 285x429 in 48h). Adds a new, ungated weekly-usage-limit text classifier that applies a 24h QUOTA_EXHAUSTED cooldown regardless of provider category. Extracted the new classifier -- together with the existing #2321 subscription-quota logic -- into a new open-sse/services/quotaTextCooldowns.ts module so the frozen accountFallback.ts (file-size-baseline cap) didn't have to grow; net effect shrinks accountFallback.ts by 20 lines. This is Phase A of the plan (open-sse/services/accountFallback.ts:1038-1045 "weekly-429 cooldown"); Phase B (generic local request-counter preflight for manual provider_plans dimensions) is a separate, larger follow-up per the plan's own phasing. * chore(6817): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576) (#6726) * fix(providers): Kiro adaptive-thinking allowlist excludes sonnet-4.5/haiku-4.5 (#6576) * chore(6726): re-sync onto release tip; CHANGELOG entry → changelog.d fragment (fragments-first) * test(kiro): migrate selector-strip test to claude-sonnet-5 (only Kiro adaptive-thinking model, #6576) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(quality): rebaseline complexity 2053->2054 (merge-burst drift, v3.8.47) Inherited drift from today's /implement-prs merge burst (~36 PRs). check:complexity does not run on the PR->release fast-path, so the branch accrued +1 unmeasured. No orphan/feature PR introduces a NEW violation (complexity-net-zero); the only flagged function is the pre-existing getResolvedModelCapabilities. Owner-approved rebaseline to unblock the FQG of ~7 green-except-complexity orphans. * chore(stryker): register ollama-quota covering tests (merge-burst drift, v3.8.47) The 3 covering unit tests from #6731/#6817/#6742 (issue-6638-ollama-quota, ollama-cloud-weekly-quota-cooldown-3709, issue-6686-quota-preflight-coverage) exist on release but were never added to tap.testFiles when those PRs merged. Completes the registration so mutant kills count; unblocks every PR touching a mutated module. Part of the owner-approved merge-burst drift cleanup. * fix: auto-start WS server in-process and change default port to 20132 (#6072) * feat: change default LIVE_WS_PORT from 20129 to 20132 Update the default WebSocket port for the live dashboard server from 20129 to 20132 across all configuration files, documentation, code comments, and tests. Also consolidate OMNIROUTE_DISABLE_LIVE_WS and OMNIROUTE_ENABLE_LIVE_WS into a single OMNIROUTE_ENABLE_LIVE_WS flag. Wire the live WebSocket server to start in-process via instrumentation-node.ts. * feat: clarify NEXT_PUBLIC_LIVE_WS_PUBLIC_URL path usage and derive upgrade path from URL Update .env.example and ENVIRONMENT.md to document that the pathname portion of NEXT_PUBLIC_LIVE_WS_PUBLIC_URL (e.g. /live-ws) is used as the WebSocket upgrade path by the dev proxy, handshake response, and client connection logic. Extract deriveLiveWsPath() into shared/utils/wsPath.ts and wire it through: - src/app/api/v1/ws/route.ts — handshake response path field - src/hooks/useLiveDashboard.ts — build * fix: use the standard URL API to safely parse and update the effectiveWsUrl * build(docker): expose live WebSocket server port and configure CORS origins Add LIVE_WS_PORT (20132), LIVE_WS_HOST (0.0.0.0), and LIVE_WS_ALLOWED_ORIGINS environment variables to all Docker Compose profiles and expose the WebSocket port mapping. Prevent infinite self-loop in standalone-server-ws.mjs by skipping proxy when the server itself is running on the LiveWS port. * docs(env): fix comment formatting for HOST and HOSTNAME variables --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(logs): prevent stale detail refresh reopening modal (#6323) * fix(logs): prevent stale detail refresh reopening modal * chore(stryker): register ollama-quota covering tests (release drift from merge burst) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * \ feat: operator-configurable account rotation\ (#6763) * feat(resilience): operator-configurable account rotation Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR); the author's accountFallback/.env deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(env): document configurable account-rotation env vars in ENVIRONMENT.md Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(rotation): extract rotation gate/context helpers to keep accountFallback.ts under frozen cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip (restore lost base bullet) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(stryker): register rotation-config test in tap.testFiles for mutation coverage Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(stryker): register ollama-quota covering tests (drift from #6731/#6817/#6742) + re-sync Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> * fix(lmarena): modernize Arena web provider + static Direct-chat catalog (#6280) * fix(lmarena): modernize Arena web provider + static Direct-chat catalog Update the lmarena provider for arena.ai (product rebranded from LMArena): - Route chat via arena.ai create-evaluation with Chrome TLS impersonation (tls-client-node) and optional browser-minted recaptchaV3Token. - Seed Text+Search (48) into the chat registry; seed Image (27) only into IMAGE_PROVIDERS. Disable live HTML model discovery; resolve public names to Arena UUIDs from the static TypeScript allowlist (no scrape JSON in-repo). - Soft-exclude 404/502 model ids; slow/stop bulk test-all probes for this provider. - Do not fold IMAGE_PROVIDERS/video specialty into the chat provider catalog when a chat registry already exists (lmarena/openai/xai). - Display name Arena (Free); keep wire id `lmarena` / alias `lma` for back-compat. - Theme-aware provider icons: arena-light.svg / arena-dark.svg. - Preserve split Supabase SSR cookie reconstruction for arena-auth-prod-v1.*. * fix(providers): align provider-models-route test fixture + regen provider reference Fold the topaz image-only catalog entry's apiFormat/supportedEndpoints into the local-catalog test fixture (route now tags media-only providers per the lmarena PR's staticModels.ts change), regenerate PROVIDER_REFERENCE.md against the merged release providers.ts, and add the changelog fragment for #6280. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test: align web-cookie fallback suite — lmarena now has a registry entry (probe path) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(changelog): reconcile 3-day merge burst — 16 fragments, 4 promised credits, contributors hall 32→63 - changelog.d fragments for the 20 merged PRs that landed without a bullet (#6072 #6308 #6323 #6538 #6556 #6586 #6611 #6647 #6675 #6698 #6757 #6759 #6804 #6821 + ci rollup #6781/#6691/#6693 + docs rollup #6643/#6644/#6646/#6663; omniglyph bump #6661 folded into the #6556 bullet) - deliver the 4 credits promised in close comments but never written: @alltomatos (#6819 dup of #6721), @samimozcan (#6762/#6753 subsumed by #6790), @chirag127 (#6756 dup of #6757), @Squawk7777 (#6565 dup of #6564 — appended to the existing #6564 bullet; changelog-integrity flags that edit as a removal, intentional: ALLOW_CHANGELOG_REMOVALS justification) - rebuild the v3.8.47 Contributors hall from merged-PR authors + thanks credits + prior hall: 32 → 63 contributors * Clamp reasoning token buffer to model output cap (#6714) * fix(combo): clamp reasoning buffer to model output cap * fix(routing): preserve near-cap reasoning max tokens * fix(routing): getExplicitModelOutputCap falls through to registry cap on non-numeric synced limit_output getExplicitModelOutputCap short-circuited to null whenever a synced capability row existed, even if that row's limit_output was not a number (models.dev commonly omits it). That silently disabled the reasoning-token buffer clamp for any model with a synced row lacking an output limit. Now only return the synced value when it IS a number; otherwise fall through to registryModel.maxOutputTokens / spec.maxOutputTokens, matching the ??-chain precedence already used by getResolvedModelCapabilities(). Adds a standalone regression test (proves the fallthrough returns the real registry cap, not null) and hardens the #6274 fixture id so its no-output-cap case does not prefix-match the real glm-5.2 static spec. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(stryker): register ollama-quota covering tests (release drift from merge burst) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI (#6320) * feat(i18n): add Traditional Chinese (zh-TW) localization for frontend and CLI - Add src/i18n/messages/zh-TW.json translating frontend web UI - Add bin/cli/locales/zh-TW.json translating CLI commands and descriptors - Register zh-TW in config/i18n.json and docs/guides/I18N.md - Update scripts/i18n/generate-multilang.mjs matching the new locale setup * fix: update i18n locale count from 42 to 43 after adding zh-TW The docs strict checker (check-docs-counts-sync.mjs) validates that README.md and I18N.md reflect the real locale count. Adding zh-TW bumped the count from 42 → 43. * fix(i18n): translate providers free-filter labels in zh-TW (#6694 guard) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com> * feat(proxy): implement latency-optimized proxy rotation strategy (#6798) * feat(proxy): implement latency-optimized proxy rotation strategy Reconstructed onto release/v3.8.47 to drop unrelated main-drift (deps/electron/proxy files belong to #6620, not this PR) and the direct CHANGELOG.md edit (fragments-first); the author's env/docs/i18n deltas were re-applied cleanly onto the release tip. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * fix(proxy): add latency-rotation env var to .env.example PROXY_LATENCY_WINDOW_HOURS was referenced in src/lib/db/proxies.ts and documented in docs/reference/ENVIRONMENT.md, but missing from .env.example, tripping the env/docs sync gate. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(changelog): re-sync CHANGELOG.md to release tip Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(proxy): extract latency-strategy helpers to keep frozen files under cap Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * test(db-rules): expect 35 audited modules (proxyLatency joins INTENTIONALLY_INTERNAL) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * docs(readme): fix stale strategy/tool/scoring counts (#6853) README still claimed 17 routing strategies (the table was missing pipeline), 95 MCP tools, and 9-factor Auto-Combo scoring. Align with the source (ROUTING_STRATEGY_VALUES has 18 entries) and the canonical docs (MCP-SERVER.md: 94 tools; AUTO-COMBO.md: 12-factor). * fix(antigravity): sanitize Cloud Code safety settings (#6839) Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com> * fix(kiro): probe IdC region during profileArn discovery, cross-region (recovers #6099) (#6840) * fix(kiro): route Amazon Q runtime by profileArn region for cross-region IdC Enterprise AWS IAM Identity Center accounts whose IdC instance lives outside the two Amazon Q Developer profile regions (us-east-1 / eu-central-1) - e.g. eu-north-1 (Stockholm), start URL https://d-XXXX.awsapps.com/start - showed no limits and returned 502 on every request. Root cause: the backend used the IdC/OIDC token region (providerSpecificData.region, e.g. eu-north-1) for every CodeWhisperer runtime call, hitting q.eu-north-1.amazonaws.com - a host that does not exist as a Q Developer runtime endpoint. Per AWS docs ("Supported Regions for the Q Developer console and Q Developer profile"), the Q Developer *profile* (which produces the profileArn and hosts generateAssistantResponse / GetUsageLimits / ListAvailableModels / ListAvailableProfiles) is only hosted in us-east-1 and eu-central-1, regardless of the IdC region; "data is stored in the Region where you create the Amazon Q Developer profile." Fix (new open-sse/services/kiroRegion.ts) decouples the two regions: - providerSpecificData.region stays the IdC/OIDC region, used ONLY for oidc.{region}.amazonaws.com token mint/refresh. - The runtime region is derived from the profileArn (resolveKiroRuntimeRegion): profileArn region -> a valid stored profile region -> us-east-1. A stored IdC region that is not a Q profile region (eu-north-1) is ignored for runtime. - Profile discovery (discoverKiroProfileArnAcrossRegions) probes the Q profile regions (EU IdC -> eu-central-1 first) with the cross-region SSO token instead of q.{idcRegion}. Wired into: executors/kiro.ts (generateAssistantResponse targets the profile region), services/usage/kiro.ts (getKiroUsage multi-region discovery + profileArn runtime region so Limits resolves), services/kiroModels.ts (ListAvailableModels), and src/lib/oauth/providers/kiro.ts (login-time postExchange profile discovery). Adds tests/unit/kiro-idc-cross-region.test.ts (15 cases). All Kiro suites pass (60 tests). * fix(kiro): probe the IdC region too during profileArn discovery (any IdC region) Make profile discovery general for an IdC in ANY of the ~30 IdC-supported AWS regions (us-west-2, ap-southeast-2, me-central-1, af-south-1, ...), not just eu-north-1. buildKiroProfileDiscoveryRegions now probes the two documented Q Developer profile regions FIRST (us-east-1 / eu-central-1, EU-first for EMEA IdC regions to cut latency), then appends the IdC/stored region itself as a forward-compatible fallback: if AWS ever co-locates the profile with the IdC or expands the profile-region list, a same-region probe still finds it. Probing a region with no profile simply returns nothing and we fall through. The profileArn's own region remains authoritative for every runtime call (resolveKiroRuntimeRegion), so a newly-issued ARN in any region is honored automatically. Adds ap-southeast-2 (APAC) cross-region coverage and updates the discovery-order tests. --------- Co-authored-by: artickc <artur1992123@mail.ru> * feat(providers): manual context-window override for custom models (#4125) (#6822) Add a manual per-model "Context Window Override" so an operator can correct a provider's misreported context length (e.g. reports 1M when the real limit is 128K) instead of the model getting silently dropped from combo routing once the wrong value lands in the catalog. Reuses the existing Feature-5004 model_context_overrides table (source="manual") — already the priority-0 source getModelContextLimit() (the function combo's context-window filter calls) reads ahead of the models.dev/registry/static catalog — so no new resolver logic was needed, only the missing write path: - PUT /api/provider-models now accepts an optional contextWindowOverride (number to set, null to clear), persisted via setModelContextOverride/ removeModelContextOverride. - GET /api/provider-models surfaces the current override value + source back on each custom-model row. - CustomModelsSection.tsx: edit form gained a Context Window Override input + a badge on the model row when an override is set. Regression guard: tests/unit/provider-models-context-window-override-4125.test.ts (manual override wins over a misreported catalog value, GET round-trip, clearing via null, default-unchanged behavior). * feat(dashboard): improve Provider Quota page horizontal density (#3520) (#6815) QuotaCardGrid stacked every provider group vertically in a single flex flex-col container, and each group's own card grid didn't go multi-column until the md breakpoint. Provider groups now flow into a 2-column CSS multi-column layout on very wide (2xl) screens instead of an unconditional vertical stack, and each group's card grid starts at 2 columns immediately, filling horizontal whitespace sooner on narrower-but-not-mobile viewports. Regression guard: tests/unit/quota-card-grid-horizontal-layout.test.ts * refactor(usage): type saveRequestUsage with UsageEntry interface + any-budget ratchet (#3512) (#6809) Replace saveRequestUsage(entry: any) with a typed UsageEntry interface mirroring the usage_history columns 1:1. Fields stay optional/nullable since different writers (chatCore success/failure, rejected-request accounting, Codex Responses WS) populate the row incrementally; tokens stays unknown since callers pass either raw provider-shaped usage or the normalized {input,output,cacheRead,...} shape. Also cleaned the file's other any usages (getUsageHistory filter, getUsageDb next-cursor cast, appendRequestLog tokens param, getRecentLogs catch) so it now sits at zero any and can be added to the check:any-budget:t11 zero-any allowlist. Documents the DB-entity <-> TS-interface convention in docs/architecture/CODEBASE_DOCUMENTATION.md Sec 11. * feat(combo): strict budget-cap fallback policy for auto/* combos (#3470) (#6816) Auto-combo transparency + budget controls: the engine's budgetCap enforcement always degraded to the globally cheapest candidate when every candidate exceeded the cap - silently overspending instead of respecting the cap. - engine.ts: budgetFallback "cheapest" (default, legacy) | "strict" (BudgetExceededError when no candidate fits budgetCap) - requestControls.ts: X-OmniRoute-Budget-Fallback header + resolveRequestAutoControls() consolidating mode/budget/fallback parsing - resolveAutoStrategy.ts / autoConfig.ts: thread combo-level config.budgetFallback and catch BudgetExceededError into an HTTP 402 - chat.ts: switch to the consolidated resolveRequestAutoControls() helper (net line reduction, stays under the frozen file-size baseline) Regression guard: tests/unit/auto-combo-budget-fallback-3470.test.ts * fix(usage): honor xAI provider-reported exact cost (#6711) OmniRoute's calculateCost() always estimated request cost from token counts x static pricing, discarding xAI's exact provider-reported cost when present. xAI's chat-completions usage object reports the precise billed cost via cost_in_usd_ticks (docs.x.ai/developers/cost-tracking and the API reference's usage schema: "TICKS_IN_USD_CENT: i64 = 100_000_000" => 1e10 ticks/USD, e.g. 37756000 ticks ~= $0.0038). calculateCost()/computeCostFromPricing() now short-circuit to this exact figure when present -- before any pricing DB lookup, so it also works for models without a local pricing row -- and still fall back to the token-based estimate when it is absent. The field is threaded through both the streaming (extractUsage/normalizeUsage) and non-streaming (extractUsageFromResponse) usage-extraction paths. Corrected divisor vs upstream: the upstream PR used /1e12 (a 100x under-report, e.g. reporting $0.00123 as the doc's $0.123 example); this port uses the doc-verified /1e10 instead, confirmed against both the cost-tracking guide and the API reference's usage-object schema. Inspired-by: https://github.com/decolua/9router/pull/2453 Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> * docs: rename /implement-prs → /merge-prs in Hard Rule #21 (skill renamed 2026-07-11) (#6847) * docs: refresh stale llm.txt facts + relocate design.md to docs/architecture/DESIGN_SYSTEM.md (#6849) * docs: refresh stale llm.txt facts + move design.md to docs/architecture/DESIGN_SYSTEM.md llm.txt was frozen at the v3.8.8 era (177 providers, 37 MCP tools, 14 strategies, 9-factor scoring, 75% coverage gate). Update every factual claim to the current state (248 providers, 94 tools / 30 scopes, 18 strategies, 12-factor scoring, ratchet + 60% floor, TS 6, current docs/ layout) and re-sync the 42 exact-copy i18n mirrors. design.md at the root was a standardization plan whose phases 1-6 all shipped; rewrite its header as a permanent reference and relocate it to docs/architecture/DESIGN_SYSTEM.md per the root-hygiene policy (root = configs + canonical docs only). * docs: add MDX frontmatter to DESIGN_SYSTEM.md (in-app docs pipeline requires it) * feat: per-model web-search interception rule (#3384) (#6814) * feat(routing): per-model web-search interception rule (#3384) Adds a per-provider/per-model interceptSearch rule (src/lib/db/interceptionRules.ts, key_value namespace interception_rules) that overrides the existing native web-search bypass defaults (Codex/Gemini/Claude->Claude passthrough) in webSearchFallback.ts. Wired at the existing prepareWebSearchFallbackBody() call site in chatCore.ts. Resolution precedence: per-model rule > provider-level rule > existing native-bypass defaults. This lands Phase 1-2 of the plan (rule store + search interception). Web-fetch interception and the dashboard UI toggle are tracked as follow-up phases. * fix(db): register interceptionRules in localDb re-export layer (db-rules gate) * fix(db): renumber interception_rules migration 119→120 (collision with model_capability_overrides) * feat: sidebar search/filter input (#4013) (#6810) * feat(dashboard): add search/filter input to the dashboard sidebar (#4013) Adds a search box at the top of the expanded sidebar that filters nav sections/groups/items client-side by label, so users don't have to hunt through the growing nav tree. Reuses the existing common.search / common.noResults i18n keys (no new locale edits needed) and the shared Input icon="search" pattern. Matching sections auto-expand while searching and the accordion/pin state is restored once the query is cleared. Filtering logic is extracted into a pure filterSidebarSectionsByQuery() helper (src/shared/utils/sidebarSearch.ts) so it is trivially unit testable independent of React/next-intl/next-navigation. * fix(test): move Sidebar.search test to a runner-collected path (test-discovery gate) * fix(i18n): backfill 194 missing pt-BR keys (#6695) (#6723) * fix(i18n): backfill 194 missing pt-BR keys and add key-parity regression test (#6695) * Merge branch 'release/v3.8.47' into fix/6695-i18n-drift Resolve i18n key-parity and CHANGELOG-fragment conflicts: - Convert the #6695 CHANGELOG.md bullet to a changelog.d/ fragment (the fragment convention landed on release/v3.8.47 after this PR branched, per changelog.d/README.md). - Backfill 61 additional pt-BR keys that entered en.json on release/v3.8.47 after this PR's original 194-key backfill, so the PR's own key-parity regression test (tests/unit/i18n-pt-br.test.ts) stays green against the moving release baseline. * Discover live Codex models (#6776) * Add live model discovery for provider catalog * Fix model discovery request headers * fix(codex): sync live model limits with local catalog * test(codex): split live model discovery coverage into dedicated route tests * fix(codex): use chatgpt account id for live model sync * Add GitHub-backed Codex model discovery fallback * fix(providers): tighten oauth config tests and provider model display comments * test: align client version expectations with release default * fix(codex): keep discovery complexity within baseline * fix: rebase live Codex model discovery onto release/v3.8.47, preserving kimi-web buildHeaders (#6308) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697) (#6820) * feat(codex): echo requested effort-suffixed model id in Responses payloads (#3697) Codex CLI compatibility shim: the Responses API response.created/ response.in_progress/response.completed payloads now carry a `model` field (previously absent), and for Codex-CLI-originated requests it echoes the client-requested effort-suffixed model id (e.g. gpt-5.5-xhigh) instead of the bare upstream id (gpt-5.5), so the Codex CLI status line/model button shows the active reasoning effort. - openai-responses.ts translator threads the upstream model into the Responses event objects (additive, omitted when unknown). - New isCodexOriginatedHeaders() (codexIdentity.ts) reuses PR #3481's originator/User-Agent detection, header-based so it still fires when a combo routes codex/gpt-5.5-xhigh to a non-codex upstream. - chatCore's existing opt-in #1311 echoModel pipeline now also fires automatically for Codex clients on the Responses API, regardless of the echoRequestedModelName setting. - responseModelEcho.ts now also rewrites the nested response.model field the Responses API uses (previously only top-level model). - /v1/models keeps returning models: [] for Codex (unchanged, #3481). Regression guard: tests/unit/codex-effort-model-echo-3697.test.ts. Closes #3697 * chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet) * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017) (#6818) * feat(usage): surface Antigravity weekly quota alongside the 5-hour window (#4017) Antigravity enforces both a 5-hour and a weekly usage limit, but the agy/antigravity quota widget only exposed the 5-hour window. The weekly limit isn't in the per-model retrieveUserQuota response already fetched — it lives in a separate, undocumented retrieveUserQuotaSummary RPC that groups models into families (Gemini Models, Claude and GPT models) with one weekly bucket per family. Adds a self-contained usage/antigravityWeeklyQuota.ts leaf: a cached, best-effort fetch of that RPC + a pure parser that extracts the weekly-labeled bucket per group (window inferred from bucketId/displayName text, matching the reverse-engineered shape documented by third-party Antigravity clients) into gemini_weekly/ claude_gpt_weekly quota entries, merged into the existing quotas map the widget already renders generically. A failed/unavailable RPC never affects the existing per-model quotas. Live VPS validation attempt (192.168.0.15, real antigravity account): both retrieveUserQuota and retrieveUserQuotaSummary currently return 429 RESOURCE_EXHAUSTED for that account, so the live response shape could not be captured directly. The parser was instead validated via TDD against the bucket shape documented by CodexBar (steipete/CodexBar), a third-party Antigravity client that reverse-engineered the same RPC, and is defensive against both response envelopes it has observed (top-level groups[] and nested quotaSummary.groups[]). * chore(merge): re-sync with release/v3.8.47 (restore CHANGELOG, keep own bullet) * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * feat: add Z.ai Web free web-cookie provider (#4056) (#6823) * feat(providers): add Z.ai Web free web-cookie provider (#4056) New zai-web web-session provider drives the free chat.z.ai consumer chat UI via a pasted browser cookie, distinct from the existing API-key zai/glm/glm-cn/glmt providers (api.z.ai). ZaiWebExecutor posts to chat.z.ai/api/chat/completions with the cookie forwarded both as Cookie and Authorization: Bearer <token>, and normalizes both z.ai's internal delta_content/phase SSE envelope and a pass-through OpenAI-shaped choices[].delta frame into standard chat-completion chunks. Registered in WEB_COOKIE_PROVIDERS, WEB_SESSION_CREDENTIAL_REQUIREMENTS, the provider registry (GLM-4.6/4.5/4.5V models), the executor factory, and tokenExtractionConfig.ts for in-app cookie capture. * fix(providers): regenerate translate-path golden for zai-web + reduce cognitive complexity * fix(providers): rename ZaiWebExecutor.buildHeaders to avoid incompatible BaseExecutor override * chore(merge): re-sync with release/v3.8.47; move changelog bullet to changelog.d fragment (merge-storm proof) * fix(codex): bump default client version to 0.144.0 (#6780) Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * refactor(usage): extract per-group parsing in antigravityWeeklyQuota (cognitive-complexity gate 886→885, release-level drift from #6818 merge) * ci(quality): cut PR gate wall time without dropping protection (#6716) Collapse duplicate CI spend while keeping each gate's existence reason: - quality.yml: TIA __RUN_ALL__ defers full unit to fast-unit 4-shard (#6781); path filters via classify-pr-changes; docs-gates split; draft skip - ci.yml: wire docs/i18n/code path filters; ESLint JSON artifact for quality-gate; drop advisory typecheck:noimplicit; float actions/cache@v6 - TIA parity: memory/usage/combo/serial; **/*.test.mjs any depth; electron/bin no longer force unit __RUN_ALL__ - check:complexity-ratchets: one ESLint walk, ruleId-isolated baselines + cache - check:api-docs-refs + lib/apiRoutes: shared API route inventory - husky pre-push: intentionally light (gates live in pre-commit); CLAUDE.md + QUALITY_GATES.md docs synced - collect-metrics / lint:json: path.resolve cache path; Windows-safe eslint bin - env-doc allowlist for ESLINT_RESULTS_JSON / COMPLEXITY_ESLINT_REPORT - release-green --full-ci expects check:api-docs-refs (not docs-symbols alone) Tests: select-impacted, classify-pr-changes, api-routes lib, complexity-rule-count, validate-release-green. Reconciled after #6781 (fast-unit 2→4 shards) per maintainer request on #6716. Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> * fix(docs): document Turbopack build memory tradeoff for RAM-constrained machines (#6409) (#6885) * fix(routing): recognize Kimi token-limit 400 as context overflow for combo fallback (#6637) (#6893) combo.ts's isContextOverflow400() guard required the literal word 'context' in the 400 error body before letting a combo fall through to the next target. Kimi's exact wording ('Your request exceeded model token limit: 262144 (requested: 308458)') never says 'context', so the guard misclassified it as a body-specific error and halted the whole combo instead of trying the next (larger-context) target. accountFallback.ts's CONTEXT_OVERFLOW_PATTERNS already recognized this wording one layer below (via checkFallbackError -> shouldFallback), so the two independently-maintained classifiers disagreed and the stricter one won. Export CONTEXT_OVERFLOW_PATTERNS from accountFallback.ts and reuse it inside combo.ts's isContextOverflow400() so both layers share a single source of truth. Regression test: tests/unit/repro-6637-kimi-token-limit.test.ts (RED on unfixed code -> GREEN after the fix). Existing #4519 guard tests (tests/unit/combo-param-validation-fallback-4519.test.ts) still pass, including the negative case that a genuinely body-specific 400 is NOT misclassified as overflow. * fix(providers): honor a provider-level proxy assigned to no-auth providers (#6272) (#6895) No-auth providers (mimocode, opencode, ...) are always dispatched with a single hardcoded connectionId ("noauth" — SYNTHETIC_NOAUTH_CONNECTION_ID in src/sse/services/auth.ts). No provider_connections row ever has id="noauth", so resolveProxyForConnection() in src/lib/db/settings.ts could never populate connectionRecord for them, and its provider-level proxy lookup (Steps 6/8) only runs when connectionRecord is present. A proxy assigned via Settings -> Providers -> mimocode was therefore silently ignored, reproducing the reporter's "same thing happen when i set the proxy directly in the provider menu" symptom. Adds a best-effort fallback (src/lib/db/settings/noAuthProxyFallback.ts): when connectionRecord could not be resolved, scan the known no-auth provider ids for a configured provider-level proxy (registry first, then legacy) before falling through to the global/direct steps. Regression test: tests/unit/proxy-noauth-provider-6272.test.ts (RED on unfixed code — resolved to level=direct/proxy=null; GREEN after the fix). * fix(dashboard): surface Claude extraUsage credits in quota card (#6806) (#6896) Enterprise-tier Claude accounts (default_raven_enterprise) don't get five_hour/seven_day utilization windows from Anthropic's OAuth usage endpoint — only an extra_usage credit-billing block. parseClaude() only read data.quotas, so quotas stayed {} and the dashboard showed "No quota data" even when extraUsage showed the account 100% exhausted. parseClaude() now folds an enabled extraUsage block into a credits-style quota row (mirroring parseCodex's bankedResetCredits pattern), both when quotas is empty and when it's already populated. * fix(db): share sql.js preinit across callers, fix named-param bind (#6628, #6802) (#6899) - preInitSqlJs() now memoizes an in-flight Promise (not just the resolved adapter) per filePath, so concurrent BATCH/STARTUP/HealthCheck/ ProviderLimitsSync callers at boot share one full-file read+WASM decode instead of each independently reloading the whole database — the thundering-herd amplifier of the OOM condition #6632 already partly fixed, left un-implemented by the reporter's own proposed fix (#6628). - sqljsAdapter's run/get/all now unwrap a lone named-parameter object (e.g. .all({ isActive: 1 }) for "WHERE is_active = @isActive", the same call shape getProviderConnections() already uses against better-sqlite3) before calling sql.js's stmt.bind(), expanding it to the @/:/$ sigil variants sql.js's own named-bind path requires. Previously the object was wrapped into an array and sql.js took the positional-bind path, throwing "Wrong API use : tried to bind a value of an unknown type ([object Object])." whenever the sql.js WASM fallback driver was active — exactly the error #6802 reported (misattributed to better-sqlite3). Regression tests added to tests/unit/db-adapters/driverFactory.test.ts and tests/unit/db-adapters/sqljsAdapter.test.ts, both proven RED against the prior code and GREEN after the fix. * fix(plugin): split OC-gate provider id from OmniRoute-facing routing id (#6859) (#6900) resolveOmniRoutePluginOptions() auto-prefixes providerId with "opencode-" (commit 75b52e286) so OpenCode 1.17.8+'s native-adapter gate accepts it as a registered provider id. That prefixed value was being reused for the OmniRoute-server-facing identifiers too: mapRawModelToModelV2's id/providerID, mapComboToModelV2's providerID, and the dynamic provider hook's combo catalog keys. OmniRoute's server has no "opencode-<x>" provider alias, so every dispatched model failed credential lookup with "No credentials for opencode-omniroute" / "No active credentials for provider: opencode-omniroute". Add a … * test(ci): static body in codex e2e mock route bridge (CodeQL #737) (#7559) CodeQL js/stack-trace-exposure flags ANY error-derived value returned in the mock route bridge's 500 path, not just error.stack — swapping .stack for error.message (in #7354, alert #736) left sibling alert #737 open on the same line. Replace the body with a static string; the test only asserts status===200, so the 500 body is never inspected. Clears the last open CodeQL alert repo-wide, unblocking the Quality Ratchet on every PR. Companion to the release/v3.8.49 PR (merge-gates §8 — gate/CI-touching fix lands on main in the same session). * fix(usage): preserve account identity history * fix(db): renumber usage-identity migration to 127 (collides with 123_quota_auto_ping) Base-red found during pre-merge validation: the fork's migration was authored as 123_usage_history_account_identity.sql, but release/v3.8.49 already carries 123_quota_auto_ping.sql at that same numeric prefix. getMigrationFiles() throws "Migration version collision detected" for any duplicate version, which was failing every test that boots the DB (db-migration-runner, usage-migrations, usage-analytics-route). Renamed to 127 (next free slot after 126_reasoning_routing_rules.sql) and updated the matching test-file-path references. Co-authored-by: Xiangzhe <xiangzhedev@gmail.com> * test(db,api): split test files to satisfy file-size gate for account identity work db-migration-runner.test.ts grew past the frozen 1499-line cap and the new usage-analytics-route.test.ts exceeded the 800-line cap for new files. Split the newly added cases into sibling files instead of rebaselining. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> * chore(quality): suppress pre-existing any in split db-migration-runner-account-identity test The test-file-size split (4885f44) moved 2 pre-existing `any` usages from usage-migrations.test.ts into the new tests/unit/db-migration-runner-account-identity.test.ts file. ESLint's suppressions file only tracks violations by filename, so the split left these 2 occurrences unsuppressed and lint-blocking on the new path. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <8016841+diegosouzapw@users.noreply.github.com> Co-authored-by: growab <nekron@icloud.com> Co-authored-by: KooshaPari <42529354+KooshaPari@users.noreply.github.com> Co-authored-by: Chirag Singhal <76880977+chirag127@users.noreply.github.com> Co-authored-by: Chirag Singhal <chirag127@users.noreply.github.com> Co-authored-by: Ronaldo Davi <ronaldodavi@gmail.com> Co-authored-by: Andrew Munsell <andrew@wizardapps.net> Co-authored-by: WITALO ROCHA <witalo_rocha@hotmail.com> Co-authored-by: Wital <witalorocha216@gmail.com> Co-authored-by: Aoxiong Yin <i@yinaoxiong.cn> Co-authored-by: Andrew B. <37745667+AndrianBalanescu@users.noreply.github.com> Co-authored-by: Andrian B. <andrewbalanesq@gmail.com> Co-authored-by: Jon Bailey <297513015+Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: Pitchfork-and-Torch <Pitchfork-and-Torch@users.noreply.github.com> Co-authored-by: Diego Rodrigues de Sa e Souza <diegosouza.pw@gmail.com> Co-authored-by: Samir Abis <me@samirabis.com> Co-authored-by: lucasjustinudin <34107354+lucasjustinudin@users.noreply.github.com> Co-authored-by: chy1211 <31048289+chy1211@users.noreply.github.com> Co-authored-by: ryanngit <74137224+ryanngit@users.noreply.github.com> Co-authored-by: whale9820 <whale9820@users.noreply.github.com> Co-authored-by: anhdiepmmk <n08ni.dieppn@gmail.com> Co-authored-by: Septianata Rizky Pratama <19322988+ianriizky@users.noreply.github.com> Co-authored-by: NOXX - Commiter <artur1992123@mail.ru> Co-authored-by: backryun <bakryun0718@proton.me> Co-authored-by: lunkerchen <labanchen@gmail.com> Co-authored-by: lunkerchen <lunkerchen@users.noreply.github.com> Co-authored-by: Ray Doan <raydoan.contact@gmail.com> Co-authored-by: kfiramar <83420275+kfiramar@users.noreply.github.com> Co-authored-by: Jan Leon <Jan.gaschler@gmail.com> Co-authored-by: Someres <168349709+quanturbo@users.noreply.github.com> Co-authored-by: MikeTuev <ra9ftm@gmail.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Imam Wahyu Widodo <120608486+hajilok@users.noreply.github.com> Co-authored-by: diegosouzapw <diegosouzapw@users.noreply.github.com> Co-authored-by: AgentKiller45 <jamalzzj45@gmail.com> Co-authored-by: judy459 <JUDYZHU459@outlook.com> Co-authored-by: Diego Rodrigues de Sa e Souza <souzamiriamrodrigues790@gmail.com> Co-authored-by: Markus Hartung <mail@hartmark.se> Co-authored-by: KooshaPari <koosha@phenotype.io> Co-authored-by: Jade Guo <jade.gly@gmail.com> Co-authored-by: Paijo <14921983+oyi77@users.noreply.github.com> Co-authored-by: oyi77 <oyi77@users.noreply.github.com> Co-authored-by: Dayna Blackwell <dayna@blackwell-systems.com> Co-authored-by: backryun <backryun@daonlab.local> Co-authored-by: brick30llc-ctrl <brick30llc@gmail.com> Co-authored-by: brick30llc-ctrl <admin@brick30.com> Co-authored-by: Saren <saren@dumstruck.com> Co-authored-by: Rafael Dias Zendron <mmmarckos@gmail.com> Co-authored-by: Rafael Dias Zendron <rafael.zendron22@gmail.com> Co-authored-by: KooshaPari <62650152+KooshaPari@users.noreply.github.com> Co-authored-by: Wibias <37517432+Wibias@users.noreply.github.com> Co-authored-by: huohua-dev <celentanohertor@gmail.com> Co-authored-by: huohua-dev <258873123+huohua-dev@users.noreply.github.com> Co-authored-by: CitrusIce <31264099+CitrusIce@users.noreply.github.com> Co-authored-by: minisforum <no@mail.com> Co-authored-by: xz-dev <xz-dev@users.noreply.github.com>
2026-07-31 04:12:10 +03:00 · 2026-07-20 08:22:57 +08:00
parent 613464c24d
commit fdf407a6d6
18 changed files with 1374 additions and 309 deletions
--- a/config/quality/eslint-suppressions.json
+++ b/config/quality/eslint-suppressions.json
@@ -1187,6 +1187,11 @@
      "count": 1
    }
  },
+  "tests/unit/db-migration-runner-account-identity.test.ts": {
+    "@typescript-eslint/no-explicit-any": {
+      "count": 2
+    }
+  },
  "tests/unit/db-migration-runner.test.ts": {
    "@typescript-eslint/no-explicit-any": {
      "count": 12
--- a/src/app/api/usage/analytics/route.ts
+++ b/src/app/api/usage/analytics/route.ts
@@ -673,7 +673,7 @@ export async function GET(request: Request) {

    const accountCostByAccount = new Map<string, number>();
    for (const row of accountCostRows) {
-      const account = toStringValue(row.account, "unknown");
+      const accountKey = toStringValue(row.accountKey, "unknown");
      const cost = computeUsageRowCost(
        row,
        pricingByProvider,
@@ -681,7 +681,7 @@ export async function GET(request: Request) {
        normalizeModelName,
        computeCostFromPricing
      );
-      accountCostByAccount.set(account, (accountCostByAccount.get(account) || 0) + cost);
+      accountCostByAccount.set(accountKey, (accountCostByAccount.get(accountKey) || 0) + cost);
    }

    const byAccount = accountRows.map((row) => ({
@@ -692,7 +692,7 @@ export async function GET(request: Request) {
      totalTokens: Number(row.totalTokens),
      avgLatencyMs: Math.round(Number(row.avgLatencyMs)),
      lastUsed: row.lastUsed,
-      cost: roundCost(accountCostByAccount.get(toStringValue(row.account, "unknown")) || 0),
+      cost: roundCost(accountCostByAccount.get(toStringValue(row.accountKey, "unknown")) || 0),
    }));

    const apiKeyMap = new Map<
--- a/src/lib/db/core.ts
+++ b/src/lib/db/core.ts
@@ -41,6 +41,7 @@ import { isAutomatedTestProcess } from "@/shared/utils/testProcess";
 export { toSnakeCase, toCamelCase, objToSnake, rowToCamel, cleanNulls } from "./caseMapping";
 import {
  ensureProviderConnectionsColumns,
+  ensureUsageHistoryAccountIndex,
  ensureUsageHistoryColumns,
  ensureCallLogsColumns,
  hasTable,
@@ -302,6 +303,9 @@ const SCHEMA_SQL = `
    provider TEXT,
    model TEXT,
    connection_id TEXT,
+    account_key TEXT,
+    account_label TEXT,
+    account_label_priority INTEGER DEFAULT 0,
    api_key_id TEXT,
    api_key_name TEXT,
    tokens_input INTEGER DEFAULT 0,
@@ -958,6 +962,7 @@ export function getDbInstance(): SqliteDatabase {
    memoryDb.pragma("journal_mode = WAL");
    memoryDb.exec(SCHEMA_SQL);
    ensureUsageHistoryColumns(memoryDb);
+    ensureUsageHistoryAccountIndex(memoryDb);
    ensureCallLogsColumns(memoryDb);
    ensureProviderConnectionsColumns(memoryDb);
    setDb(memoryDb);
--- a/src/lib/db/jsonMigration.ts
+++ b/src/lib/db/jsonMigration.ts
@@ -13,6 +13,11 @@

 import type { SqliteAdapter } from "./adapters/types";
 import { normalizeRoutingStrategy } from "@/shared/constants/routingStrategies";
+import {
+  resolveImportedUsageAccountIdentity,
+  resolveOrphanedUsageAccountIdentity,
+  resolveUsageAccountIdentity,
+} from "@/lib/usage/accountIdentity";

 type SqliteDatabase = SqliteAdapter;

@@ -223,23 +228,36 @@ export function runJsonMigration(
    }
    // 7. Usage History
    if (data.usageHistory && data.usageHistory.length > 0) {
+      const importedConnections = new Map(
+        (data.providerConnections ?? []).map((connection) => [connection.id, connection])
+      );
      const insertUsageHistory = db.prepare(`
        INSERT OR REPLACE INTO usage_history (
-          id, provider, model, connection_id, api_key_id, api_key_name,
-          tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation,
-          tokens_reasoning, status, success, latency_ms, ttft_ms, error_code, combo_strategy, timestamp
+          id, provider, model, connection_id, account_key, account_label, account_label_priority,
+          api_key_id, api_key_name, tokens_input, tokens_output, tokens_cache_read,
+          tokens_cache_creation, tokens_reasoning, status, success, latency_ms, ttft_ms,
+          error_code, combo_strategy, timestamp
        ) VALUES (
-          @id, @provider, @model, @connection_id, @api_key_id, @api_key_name,
-          @tokens_input, @tokens_output, @tokens_cache_read, @tokens_cache_creation,
-          @tokens_reasoning, @status, @success, @latency_ms, @ttft_ms, @error_code, @combo_strategy, @timestamp
+          @id, @provider, @model, @connection_id, @account_key, @account_label,
+          @account_label_priority, @api_key_id, @api_key_name, @tokens_input, @tokens_output,
+          @tokens_cache_read, @tokens_cache_creation, @tokens_reasoning, @status, @success,
+          @latency_ms, @ttft_ms, @error_code, @combo_strategy, @timestamp
        )
      `);
      for (const row of data.usageHistory) {
+        const connection = importedConnections.get(row.connection_id);
+        const fallbackIdentity = connection
+          ? resolveUsageAccountIdentity(connection)
+          : resolveOrphanedUsageAccountIdentity(row.provider, row.connection_id);
+        const identity = resolveImportedUsageAccountIdentity(row, fallbackIdentity);
        insertUsageHistory.run({
          id: row.id,
          provider: row.provider ?? null,
          model: row.model ?? null,
          connection_id: row.connection_id ?? null,
+          account_key: identity.accountKey,
+          account_label: identity.accountLabel,
+          account_label_priority: identity.accountLabelPriority,
          api_key_id: row.api_key_id ?? null,
          api_key_name: row.api_key_name ?? null,
          tokens_input: row.tokens_input ?? 0,
--- a/src/lib/db/migrations/127_usage_history_account_identity.sql
+++ b/src/lib/db/migrations/127_usage_history_account_identity.sql
@@ -0,0 +1,153 @@
+-- Migration 127: Snapshot stable account identity on usage events.
+-- Startup schema ensure adds the columns first so an interrupted pre-marker
+-- upgrade can rerun this atomic backfill and index creation.
+
+UPDATE usage_history
+SET
+  account_key = COALESCE(
+    (
+      SELECT CASE
+        WHEN c.auth_type = 'oauth'
+          AND c.provider = 'codex'
+          AND json_valid(COALESCE(c.provider_specific_data, ''))
+          AND json_type(c.provider_specific_data, '$.workspaceId') = 'text'
+          AND json_extract(c.provider_specific_data, '$.workspaceId') <> ''
+          AND c.email <> ''
+        THEN json_array(
+          'oauth',
+          c.provider,
+          'workspace',
+          json_extract(c.provider_specific_data, '$.workspaceId'),
+          'email',
+          c.email
+        )
+        WHEN c.auth_type = 'oauth'
+          AND c.provider = 'codex'
+          AND json_valid(COALESCE(c.provider_specific_data, ''))
+          AND json_type(c.provider_specific_data, '$.chatgptUserId') = 'text'
+          AND json_extract(c.provider_specific_data, '$.chatgptUserId') <> ''
+          AND c.email <> ''
+        THEN json_array(
+          'oauth',
+          c.provider,
+          'user',
+          json_extract(c.provider_specific_data, '$.chatgptUserId'),
+          'email',
+          c.email
+        )
+        WHEN c.auth_type = 'oauth'
+          AND c.provider <> 'codex'
+          AND c.email <> ''
+          AND json_valid(COALESCE(c.provider_specific_data, ''))
+          AND json_type(c.provider_specific_data, '$.username') = 'text'
+          AND json_extract(c.provider_specific_data, '$.username') <> ''
+        THEN json_array(
+          'oauth',
+          CASE WHEN typeof(c.provider) = 'text' AND c.provider <> '' THEN c.provider ELSE 'unknown' END,
+          'email',
+          c.email,
+          'username',
+          json_extract(c.provider_specific_data, '$.username')
+        )
+        WHEN c.auth_type = 'oauth'
+          AND c.provider <> 'codex'
+          AND c.email <> ''
+        THEN json_array(
+          'oauth',
+          CASE WHEN typeof(c.provider) = 'text' AND c.provider <> '' THEN c.provider ELSE 'unknown' END,
+          'email',
+          c.email
+        )
+        ELSE json_array(
+          'connection',
+          CASE WHEN typeof(c.provider) = 'text' AND c.provider <> '' THEN c.provider ELSE 'unknown' END,
+          CASE
+            WHEN typeof(c.id) = 'text' AND c.id <> '' THEN c.id
+            WHEN typeof(usage_history.connection_id) = 'text' AND usage_history.connection_id <> ''
+            THEN usage_history.connection_id
+            ELSE 'unknown'
+          END
+        )
+      END
+      FROM provider_connections c
+      WHERE c.id = usage_history.connection_id
+    ),
+    json_array(
+      'connection',
+      CASE
+        WHEN typeof(usage_history.provider) = 'text' AND usage_history.provider <> ''
+        THEN usage_history.provider
+        ELSE 'unknown'
+      END,
+      CASE
+        WHEN typeof(usage_history.connection_id) = 'text' AND usage_history.connection_id <> ''
+        THEN usage_history.connection_id
+        ELSE 'unknown'
+      END
+    )
+  ),
+  account_label = COALESCE(
+    (
+      SELECT COALESCE(
+        NULLIF(TRIM(c.display_name), ''),
+        NULLIF(TRIM(c.email), ''),
+        NULLIF(TRIM(c.name), ''),
+        NULLIF(TRIM(c.id), '')
+      )
+      FROM provider_connections c
+      WHERE c.id = usage_history.connection_id
+    ),
+    NULLIF(TRIM(usage_history.connection_id), ''),
+    'unknown'
+  ),
+  account_label_priority = COALESCE(
+    (
+      SELECT CASE
+        WHEN NULLIF(TRIM(c.display_name), '') IS NOT NULL THEN 4
+        WHEN NULLIF(TRIM(c.email), '') IS NOT NULL THEN 3
+        WHEN NULLIF(TRIM(c.name), '') IS NOT NULL THEN 2
+        WHEN NULLIF(TRIM(c.id), '') IS NOT NULL THEN 1
+        ELSE 0
+      END
+      FROM provider_connections c
+      WHERE c.id = usage_history.connection_id
+    ),
+    CASE WHEN NULLIF(TRIM(usage_history.connection_id), '') IS NOT NULL THEN 1 ELSE 0 END
+  )
+WHERE account_key IS NULL OR account_key = '';
+
+UPDATE usage_history
+SET
+  account_label = COALESCE(
+    (
+      SELECT COALESCE(
+        NULLIF(TRIM(c.display_name), ''),
+        NULLIF(TRIM(c.email), ''),
+        NULLIF(TRIM(c.name), ''),
+        NULLIF(TRIM(c.id), '')
+      )
+      FROM provider_connections c
+      WHERE c.id = usage_history.connection_id
+    ),
+    NULLIF(TRIM(usage_history.connection_id), ''),
+    'unknown'
+  ),
+  account_label_priority = COALESCE(
+    (
+      SELECT CASE
+        WHEN NULLIF(TRIM(c.display_name), '') IS NOT NULL THEN 4
+        WHEN NULLIF(TRIM(c.email), '') IS NOT NULL THEN 3
+        WHEN NULLIF(TRIM(c.name), '') IS NOT NULL THEN 2
+        WHEN NULLIF(TRIM(c.id), '') IS NOT NULL THEN 1
+        ELSE 0
+      END
+      FROM provider_connections c
+      WHERE c.id = usage_history.connection_id
+    ),
+    CASE WHEN NULLIF(TRIM(usage_history.connection_id), '') IS NOT NULL THEN 1 ELSE 0 END
+  )
+WHERE account_key IS NOT NULL
+  AND account_key <> ''
+  AND (account_label IS NULL OR account_label = '');
+
+CREATE INDEX IF NOT EXISTS idx_uh_account_key ON usage_history(account_key);
--- a/src/lib/db/providers.ts
+++ b/src/lib/db/providers.ts
@@ -16,6 +16,7 @@ import { invalidateReasoningRoutingRuleCache } from "./reasoningRoutingRules";
 import { normalizeProviderSpecificData } from "@/lib/providers/requestDefaults";
 import { bumpProxyConfigGeneration } from "./settings";
 import { webSessionCredentialKey, parseProviderSpecificData } from "./webSessionDedup";
+import { resolveUsageAccountIdentity } from "@/lib/usage/accountIdentity";
 import {
  withNullableMaxConcurrent,
  withNullableQuotaWindowThresholds,
@@ -39,6 +40,7 @@ interface StatementLike<TRow = unknown> {

 interface DbLike {
  prepare: <TRow = unknown>(sql: string) => StatementLike<TRow>;
+  transaction: <T>(fn: () => T) => () => T;
 }

 // Real column set for provider_connections (must match the CREATE TABLE in
@@ -244,6 +246,7 @@ export async function createProviderConnection(data: JsonRecord) {
  // For Codex/OpenAI, a single email can have multiple workspaces (Team + Personal)
  // We need to check for workspace uniqueness, not just email
  let existing: JsonRecord | null = null;
+  let legacyCodexWorkspaceMatch = false;

  if (data.authType === "oauth" && data.email) {
    // For Codex, check for existing connection with same workspace
@@ -269,6 +272,7 @@ export async function createProviderConnection(data: JsonRecord) {
              "SELECT * FROM provider_connections WHERE provider = ? AND auth_type = 'oauth' AND json_extract(provider_specific_data, '$.workspaceId') = ? AND (email IS NULL OR email = '')"
            )
            .get(data.provider, workspaceId) as JsonRecord | undefined) || null;
+        legacyCodexWorkspaceMatch = existing !== null;
      }
      // For Codex with workspaceId, don't fall back to email-only check
      // This allows creating new connections for different workspaces
@@ -371,7 +375,34 @@ export async function createProviderConnection(data: JsonRecord) {
      toStringOrNull(merged.provider),
      merged.providerSpecificData
    );
-    _updateConnectionRow(db, existingId, merged);
+    db.transaction(() => {
+      if (legacyCodexWorkspaceMatch) {
+        const oldIdentity = resolveUsageAccountIdentity(existing);
+        const newIdentity = resolveUsageAccountIdentity(merged);
+        db.prepare(
+          `UPDATE usage_history
+           SET account_key = @newAccountKey,
+               account_label = CASE
+                 WHEN @newLabelPriority > COALESCE(account_label_priority, 0)
+                 THEN @newLabel
+                 ELSE account_label
+               END,
+               account_label_priority = MAX(
+                 COALESCE(account_label_priority, 0),
+                 @newLabelPriority
+               )
+           WHERE connection_id = @connectionId
+             AND account_key = @oldAccountKey`
+        ).run({
+          connectionId: existingId,
+          oldAccountKey: oldIdentity.accountKey,
+          newAccountKey: newIdentity.accountKey,
+          newLabel: newIdentity.accountLabel,
+          newLabelPriority: newIdentity.accountLabelPriority,
+        });
+      }
+      _updateConnectionRow(db, existingId, merged);
+    })();
    backupDbFile("pre-write");
    return withNullableRateLimitOverrides(
      withNullableQuotaWindowThresholds(
--- a/src/lib/db/schemaColumns.ts
+++ b/src/lib/db/schemaColumns.ts
@@ -18,6 +18,18 @@ export function ensureProviderConnectionsColumns(db: SqliteDatabase) {
      name?: string;
    }>;
    const columnNames = new Set(columns.map((column) => String(column.name ?? "")));
+    for (const [column, type] of [
+      ["auth_type", "TEXT"],
+      ["name", "TEXT"],
+      ["email", "TEXT"],
+      ["display_name", "TEXT"],
+      ["provider_specific_data", "TEXT"],
+    ]) {
+      if (!columnNames.has(column)) {
+        db.exec(`ALTER TABLE provider_connections ADD COLUMN ${column} ${type}`);
+        console.log(`[DB] Added provider_connections.${column} column`);
+      }
+    }
    if (!columnNames.has("rate_limit_protection")) {
      db.exec(
        "ALTER TABLE provider_connections ADD COLUMN rate_limit_protection INTEGER DEFAULT 0"
@@ -81,6 +93,15 @@ export function ensureProviderConnectionsColumns(db: SqliteDatabase) {
  }
 }

+export function ensureUsageHistoryAccountIndex(db: SqliteDatabase) {
+  try {
+    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_account_key ON usage_history(account_key)");
+  } catch (error: unknown) {
+    const message = error instanceof Error ? error.message : String(error);
+    console.warn("[DB] Failed to verify usage_history account index:", message);
+  }
+}
+
 export function ensureUsageHistoryColumns(db: SqliteDatabase) {
  try {
    const columns = db.prepare("PRAGMA table_info(usage_history)").all() as Array<{
@@ -114,6 +135,18 @@ export function ensureUsageHistoryColumns(db: SqliteDatabase) {
      console.log("[DB] Added usage_history.combo_strategy column");
    }
    db.exec("CREATE INDEX IF NOT EXISTS idx_uh_combo_strategy ON usage_history(combo_strategy)");
+    if (!columnNames.has("account_key")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN account_key TEXT");
+      console.log("[DB] Added usage_history.account_key column");
+    }
+    if (!columnNames.has("account_label")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN account_label TEXT");
+      console.log("[DB] Added usage_history.account_label column");
+    }
+    if (!columnNames.has("account_label_priority")) {
+      db.exec("ALTER TABLE usage_history ADD COLUMN account_label_priority INTEGER DEFAULT 0");
+      console.log("[DB] Added usage_history.account_label_priority column");
+    }
  } catch (error: unknown) {
    const message = error instanceof Error ? error.message : String(error);
    console.warn("[DB] Failed to verify usage_history schema:", message);
--- a/src/lib/db/usageAnalytics.ts
+++ b/src/lib/db/usageAnalytics.ts
@@ -54,7 +54,7 @@ export function getUsageSummary(unifiedSource: string, params: AnalyticsParams):
        COALESCE(SUM(tokens_output), 0) as completionTokens,
        COALESCE(SUM(tokens_input + tokens_output), 0) as totalTokens,
        COUNT(DISTINCT model) as uniqueModels,
-        COUNT(DISTINCT connection_id) as uniqueAccounts,
+        COUNT(DISTINCT COALESCE(NULLIF(account_key, ''), NULLIF(connection_id, ''))) as uniqueAccounts,
        COUNT(DISTINCT COALESCE(NULLIF(api_key_id, ''), NULLIF(api_key_name, ''))) as uniqueApiKeys,
        COALESCE(SUM(CASE WHEN success = 1 THEN 1 ELSE 0 END), 0) as successfulRequests,
        COALESCE(AVG(latency_ms), 0) as avgLatencyMs,
@@ -315,7 +315,7 @@ export function getProviderUsageRows(
 // ---------------------------------------------------------------------------

 export interface AccountCostRow {
-  account: string;
+  accountKey: string;
  provider: string;
  model: string;
  serviceTier: string;
@@ -327,8 +327,7 @@ export interface AccountCostRow {
 }

 /**
- * Per-account cost breakdown joined with provider_connections for display names.
- * Uses `usage_history` directly (JOIN requires real table, not a subquery alias).
+ * Per-account cost breakdown grouped by the identity snapshot stored on each usage event.
 *
 * @param whereClause - SQL WHERE clause (may be empty string); column refs already
 *                      prefixed with `usage_history.` by the caller.
@@ -339,20 +338,35 @@ export function getAccountCostRows(whereClause: string, params: AnalyticsParams)
  return db
    .prepare(
      `
+      WITH account_events AS (
+        SELECT
+          COALESCE(
+            NULLIF(usage_history.account_key, ''),
+            'connection:' || COALESCE(LOWER(usage_history.provider), 'unknown') || ':' || COALESCE(usage_history.connection_id, 'unknown')
+          ) as resolved_account_key,
+          usage_history.provider,
+          usage_history.model,
+          usage_history.service_tier,
+          usage_history.tokens_input,
+          usage_history.tokens_output,
+          usage_history.tokens_cache_read,
+          usage_history.tokens_cache_creation,
+          usage_history.tokens_reasoning
+        FROM usage_history
+        ${whereClause}
+      )
      SELECT
-        COALESCE(NULLIF(c.display_name, ''), NULLIF(c.email, ''), NULLIF(c.name, ''), usage_history.connection_id, 'unknown') as account,
-        LOWER(usage_history.provider) as provider,
-        LOWER(usage_history.model) as model,
-        COALESCE(NULLIF(usage_history.service_tier, ''), 'standard') as serviceTier,
-        COALESCE(SUM(usage_history.tokens_input), 0) as promptTokens,
-        COALESCE(SUM(usage_history.tokens_output), 0) as completionTokens,
-        COALESCE(SUM(usage_history.tokens_cache_read), 0) as cacheReadTokens,
-        COALESCE(SUM(usage_history.tokens_cache_creation), 0) as cacheCreationTokens,
-        COALESCE(SUM(usage_history.tokens_reasoning), 0) as reasoningTokens
-      FROM usage_history
-      LEFT JOIN provider_connections c ON c.id = usage_history.connection_id
-      ${whereClause}
-      GROUP BY account, LOWER(usage_history.provider), LOWER(usage_history.model), serviceTier
+        account_events.resolved_account_key as accountKey,
+        LOWER(account_events.provider) as provider,
+        LOWER(account_events.model) as model,
+        COALESCE(NULLIF(account_events.service_tier, ''), 'standard') as serviceTier,
+        COALESCE(SUM(account_events.tokens_input), 0) as promptTokens,
+        COALESCE(SUM(account_events.tokens_output), 0) as completionTokens,
+        COALESCE(SUM(account_events.tokens_cache_read), 0) as cacheReadTokens,
+        COALESCE(SUM(account_events.tokens_cache_creation), 0) as cacheCreationTokens,
+        COALESCE(SUM(account_events.tokens_reasoning), 0) as reasoningTokens
+      FROM account_events
+      GROUP BY accountKey, LOWER(account_events.provider), LOWER(account_events.model), serviceTier
    `
    )
    .all(params) as AccountCostRow[];
@@ -361,6 +375,7 @@ export function getAccountCostRows(whereClause: string, params: AnalyticsParams)
 // ---------------------------------------------------------------------------

 export interface AccountUsageRow {
+  accountKey: string;
  account: string;
  requests: number;
  promptTokens: number;
@@ -371,7 +386,7 @@ export interface AccountUsageRow {
 }

 /**
- * Per-account usage aggregates joined with provider_connections for display names.
+ * Per-account usage aggregates grouped by the identity snapshot stored on each usage event.
 *
 * @param whereClause - SQL WHERE clause (may be empty string); column refs already
 *                      prefixed with `usage_history.` by the caller.
@@ -385,18 +400,69 @@ export function getAccountUsageRows(
  return db
    .prepare(
      `
+      WITH account_events AS (
+        SELECT
+          usage_history.*,
+          COALESCE(NULLIF(usage_history.account_key, ''), 'connection:' || COALESCE(LOWER(usage_history.provider), 'unknown') || ':' || COALESCE(usage_history.connection_id, 'unknown')) as resolved_account_key
+        FROM usage_history
+        ${whereClause}
+      ),
+      stable_account_keys AS (
+        SELECT DISTINCT account_key
+        FROM account_events
+        WHERE account_key > ''
+      ),
+      stable_labels AS (
+        SELECT
+          stable_account_keys.account_key,
+          (
+            SELECT usage_history.account_label
+            FROM usage_history
+            WHERE usage_history.account_key = stable_account_keys.account_key
+              AND NULLIF(usage_history.account_label, '') IS NOT NULL
+            ORDER BY COALESCE(usage_history.account_label_priority, 0) DESC,
+                     usage_history.timestamp DESC,
+                     usage_history.id DESC
+            LIMIT 1
+          ) as account_label
+        FROM stable_account_keys
+      ),
+      legacy_labels AS (
+        SELECT account_key, account_label
+        FROM (
+          SELECT
+            account_events.resolved_account_key as account_key,
+            account_events.account_label,
+            ROW_NUMBER() OVER (
+              PARTITION BY account_events.resolved_account_key
+              ORDER BY COALESCE(account_events.account_label_priority, 0) DESC,
+                       account_events.timestamp DESC,
+                       account_events.id DESC
+            ) as label_rank
+          FROM account_events
+          WHERE (account_events.account_key IS NULL OR account_events.account_key = '')
+            AND NULLIF(account_events.account_label, '') IS NOT NULL
+        )
+        WHERE label_rank = 1
+      ),
+      selected_labels AS (
+        SELECT account_key, account_label FROM stable_labels
+        UNION ALL
+        SELECT account_key, account_label FROM legacy_labels
+      )
      SELECT
-        COALESCE(NULLIF(c.display_name, ''), NULLIF(c.email, ''), NULLIF(c.name, ''), usage_history.connection_id, 'unknown') as account,
-        COUNT(usage_history.id) as requests,
-        COALESCE(SUM(usage_history.tokens_input), 0) as promptTokens,
-        COALESCE(SUM(usage_history.tokens_output), 0) as completionTokens,
-        COALESCE(SUM(usage_history.tokens_input + usage_history.tokens_output), 0) as totalTokens,
-        COALESCE(AVG(usage_history.latency_ms), 0) as avgLatencyMs,
-        COALESCE(MAX(usage_history.timestamp), '') as lastUsed
-      FROM usage_history
-      LEFT JOIN provider_connections c ON c.id = usage_history.connection_id
-      ${whereClause}
-      GROUP BY account
+        account_events.resolved_account_key as accountKey,
+        COALESCE(selected_labels.account_label, account_events.connection_id, 'unknown') as account,
+        COUNT(account_events.id) as requests,
+        COALESCE(SUM(account_events.tokens_input), 0) as promptTokens,
+        COALESCE(SUM(account_events.tokens_output), 0) as completionTokens,
+        COALESCE(SUM(account_events.tokens_input + account_events.tokens_output), 0) as totalTokens,
+        COALESCE(AVG(account_events.latency_ms), 0) as avgLatencyMs,
+        COALESCE(MAX(account_events.timestamp), '') as lastUsed
+      FROM account_events
+      LEFT JOIN selected_labels
+        ON selected_labels.account_key = account_events.resolved_account_key
+      GROUP BY accountKey
      ORDER BY requests DESC
      LIMIT 50
    `
--- a/src/lib/db/usageAnalytics/sources.ts
+++ b/src/lib/db/usageAnalytics/sources.ts
@@ -104,6 +104,7 @@ export function buildUnifiedSource(opts: BuildUnifiedSourceOptions): UnifiedSour
          success,
          latency_ms,
          connection_id,
+          account_key,
          api_key_id,
          api_key_name
        FROM usage_history
@@ -122,6 +123,7 @@ export function buildUnifiedSource(opts: BuildUnifiedSourceOptions): UnifiedSour
          1 as success,
          0 as latency_ms,
          NULL as connection_id,
+          NULL as account_key,
          NULL as api_key_id,
          NULL as api_key_name
        FROM daily_usage_summary
@@ -132,7 +134,7 @@ export function buildUnifiedSource(opts: BuildUnifiedSourceOptions): UnifiedSour
          tokens_input, tokens_output,
          tokens_cache_read, tokens_cache_creation, tokens_reasoning,
          service_tier, success, latency_ms,
-          connection_id, api_key_id, api_key_name
+          connection_id, account_key, api_key_id, api_key_name
        FROM usage_history
        ${rawWhere}
       )`;
--- a/src/lib/usage/accountIdentity.ts
+++ b/src/lib/usage/accountIdentity.ts
@@ -0,0 +1,112 @@
+type UsageAccountConnection = {
+  id?: unknown;
+  provider?: unknown;
+  authType?: unknown;
+  auth_type?: unknown;
+  displayName?: unknown;
+  display_name?: unknown;
+  email?: unknown;
+  name?: unknown;
+  providerSpecificData?: unknown;
+  provider_specific_data?: unknown;
+};
+
+export type UsageAccountIdentity = {
+  accountKey: string;
+  accountLabel: string;
+  accountLabelPriority: number;
+};
+
+function identityString(value: unknown): string | null {
+  return typeof value === "string" && value ? value : null;
+}
+
+function displayString(value: unknown): string | null {
+  if (typeof value !== "string") return null;
+  const trimmed = value.trim();
+  return trimmed || null;
+}
+
+function sanePriority(value: unknown): number | null {
+  return typeof value === "number" && Number.isSafeInteger(value) && value >= 0 && value <= 4
+    ? value
+    : null;
+}
+
+function toProviderSpecificData(value: unknown): Record<string, unknown> {
+  if (value && typeof value === "object" && !Array.isArray(value)) {
+    return value as Record<string, unknown>;
+  }
+  if (typeof value !== "string" || !value) return {};
+  try {
+    const parsed = JSON.parse(value);
+    return parsed && typeof parsed === "object" && !Array.isArray(parsed)
+      ? (parsed as Record<string, unknown>)
+      : {};
+  } catch {
+    return {};
+  }
+}
+
+/**
+ * Resolve the stable, non-secret account identity stored with a usage event.
+ * The identity deliberately mirrors provider-connection OAuth dedup boundaries.
+ */
+export function resolveUsageAccountIdentity(
+  connection: UsageAccountConnection | null | undefined
+): UsageAccountIdentity {
+  const provider = identityString(connection?.provider) || "unknown";
+  const connectionId = identityString(connection?.id) || "unknown";
+  const authType = identityString(connection?.authType ?? connection?.auth_type);
+  const email = identityString(connection?.email);
+  const providerSpecificData = toProviderSpecificData(
+    connection?.providerSpecificData ?? connection?.provider_specific_data
+  );
+  const workspaceId = identityString(providerSpecificData.workspaceId);
+  const chatgptUserId = identityString(providerSpecificData.chatgptUserId);
+  const username = identityString(providerSpecificData.username);
+
+  let identityParts: string[];
+  if (authType === "oauth" && provider === "codex" && workspaceId && email) {
+    identityParts = ["oauth", provider, "workspace", workspaceId, "email", email];
+  } else if (authType === "oauth" && provider === "codex" && chatgptUserId && email) {
+    identityParts = ["oauth", provider, "user", chatgptUserId, "email", email];
+  } else if (authType === "oauth" && provider !== "codex" && email) {
+    identityParts = username
+      ? ["oauth", provider, "email", email, "username", username]
+      : ["oauth", provider, "email", email];
+  } else {
+    identityParts = ["connection", provider, connectionId];
+  }
+
+  const displayName = displayString(connection?.displayName ?? connection?.display_name);
+  const displayEmail = displayString(connection?.email);
+  const name = displayString(connection?.name);
+  const id = displayString(connection?.id);
+
+  return {
+    accountKey: JSON.stringify(identityParts),
+    accountLabel: displayName || displayEmail || name || id || "unknown",
+    accountLabelPriority: displayName ? 4 : displayEmail ? 3 : name ? 2 : id ? 1 : 0,
+  };
+}
+
+export function resolveOrphanedUsageAccountIdentity(
+  provider: unknown,
+  connectionId: unknown
+): UsageAccountIdentity {
+  return resolveUsageAccountIdentity({ provider, id: connectionId });
+}
+
+export function resolveImportedUsageAccountIdentity(
+  row: Record<string, unknown>,
+  fallback: UsageAccountIdentity
+): UsageAccountIdentity {
+  return {
+    accountKey: identityString(row.account_key ?? row.accountKey) || fallback.accountKey,
+    accountLabel: displayString(row.account_label ?? row.accountLabel) || fallback.accountLabel,
+    accountLabelPriority:
+      sanePriority(row.account_label_priority ?? row.accountLabelPriority) ??
+      fallback.accountLabelPriority,
+  };
+}
--- a/src/lib/usage/migrations.ts
+++ b/src/lib/usage/migrations.ts
@@ -17,6 +17,11 @@ import { getAppLogFilePath } from "../logEnv";
 import { protectPayloadForLog } from "../logPayloads";
 import { sanitizePII } from "../piiSanitizer";
 import { writeCallArtifact, type CallLogArtifact } from "./callLogArtifacts";
+import {
+  resolveImportedUsageAccountIdentity,
+  resolveOrphanedUsageAccountIdentity,
+  resolveUsageAccountIdentity,
+} from "./accountIdentity";

 export const shouldPersistToDisk = !isCloud && !isBuildPhase;

@@ -308,20 +313,32 @@ export function migrateUsageJsonToSqlite() {
        console.log(`[usageDb] Migrating ${history.length} usage entries from JSON → SQLite...`);

        const insert = db.prepare(`
-          INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name,
-            tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation, tokens_reasoning,
-            status, success, latency_ms, ttft_ms, error_code, combo_strategy, timestamp)
-          VALUES (@provider, @model, @connectionId, @apiKeyId, @apiKeyName,
-            @tokensInput, @tokensOutput, @tokensCacheRead, @tokensCacheCreation, @tokensReasoning,
-            @status, @success, @latencyMs, @ttftMs, @errorCode, @comboStrategy, @timestamp)
+          INSERT INTO usage_history (provider, model, connection_id, account_key, account_label,
+            account_label_priority, api_key_id, api_key_name, tokens_input, tokens_output,
+            tokens_cache_read, tokens_cache_creation, tokens_reasoning, status, success, latency_ms,
+            ttft_ms, error_code, combo_strategy, timestamp)
+          VALUES (@provider, @model, @connectionId, @accountKey, @accountLabel,
+            @accountLabelPriority, @apiKeyId, @apiKeyName, @tokensInput, @tokensOutput,
+            @tokensCacheRead, @tokensCacheCreation, @tokensReasoning, @status, @success,
+            @latencyMs, @ttftMs, @errorCode, @comboStrategy, @timestamp)
        `);
+        const findConnection = db.prepare("SELECT * FROM provider_connections WHERE id = ?");

        const tx = db.transaction(() => {
          for (const entry of history) {
+            const connectionId = entry.connectionId || entry.connection_id || null;
+            const connection = connectionId ? findConnection.get(connectionId) : null;
+            const fallbackIdentity = connection
+              ? resolveUsageAccountIdentity(connection)
+              : resolveOrphanedUsageAccountIdentity(entry.provider, connectionId);
+            const identity = resolveImportedUsageAccountIdentity(entry, fallbackIdentity);
            insert.run({
              provider: entry.provider || null,
              model: entry.model || null,
-              connectionId: entry.connectionId || null,
+              connectionId,
+              accountKey: identity.accountKey,
+              accountLabel: identity.accountLabel,
+              accountLabelPriority: identity.accountLabelPriority,
              apiKeyId: entry.apiKeyId || null,
              apiKeyName: entry.apiKeyName || null,
              tokensInput:
--- a/src/lib/usage/usageHistory.ts
+++ b/src/lib/usage/usageHistory.ts
@@ -9,6 +9,10 @@

 import { getDbInstance } from "../db/core";
 import { protectPayloadForLog } from "../logPayloads";
+import {
+  resolveOrphanedUsageAccountIdentity,
+  resolveUsageAccountIdentity,
+} from "./accountIdentity";
 import {
  accumulateLatencySample,
  asRecord,
@@ -617,6 +621,13 @@ export async function saveRequestUsage(entry: UsageEntry) {

    const tokensInput = getLoggedInputTokens(entry.tokens);
    const tokensOutput = getLoggedOutputTokens(entry.tokens);
+    const connection = entry.connectionId
+      ? (db.prepare("SELECT * FROM provider_connections WHERE id = ?").get(entry.connectionId) as
+          Record<string, unknown> | undefined)
+      : undefined;
+    const accountIdentity = connection
+      ? resolveUsageAccountIdentity(connection)
+      : resolveOrphanedUsageAccountIdentity(entry.provider, entry.connectionId);

    // Dedup guard: skip INSERT when an identical row already exists in the same
    // second. This prevents double-counting when onRequestSuccess fires more
@@ -663,15 +674,19 @@ export async function saveRequestUsage(entry: UsageEntry) {

      db.prepare(
        `
-        INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name,
-          tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation, tokens_reasoning,
-          service_tier, status, success, latency_ms, ttft_ms, error_code, combo_strategy, endpoint, timestamp)
-        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
+        INSERT INTO usage_history (provider, model, connection_id, account_key, account_label,
+          account_label_priority, api_key_id, api_key_name, tokens_input, tokens_output,
+          tokens_cache_read, tokens_cache_creation, tokens_reasoning, service_tier, status, success,
+          latency_ms, ttft_ms, error_code, combo_strategy, endpoint, timestamp)
+        VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)
      `
      ).run(
        entry.provider || null,
        entry.model || null,
        entry.connectionId || null,
+        accountIdentity.accountKey,
+        accountIdentity.accountLabel,
+        accountIdentity.accountLabelPriority,
        entry.apiKeyId || null,
        entry.apiKeyName || null,
        tokensInput,
--- a/tests/unit/db-migration-runner-account-identity.test.ts
+++ b/tests/unit/db-migration-runner-account-identity.test.ts
@@ -0,0 +1,214 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import path from "node:path";
+import { pathToFileURL } from "node:url";
+import Database from "better-sqlite3";
+
+async function importFresh(modulePath) {
+  const url = pathToFileURL(path.resolve(modulePath)).href;
+  return import(`${url}?test=${Date.now()}-${Math.random().toString(16).slice(2)}`);
+}
+
+function withMockedMigrationFs(files, fn) {
+  const originalExistsSync = fs.existsSync;
+  const originalReaddirSync = fs.readdirSync;
+  const originalReadFileSync = fs.readFileSync;
+
+  const isMigrationDir = (target) =>
+    String(target).replaceAll("\\", "/").endsWith("/src/lib/db/migrations") ||
+    String(target).replaceAll("\\", "/").endsWith("/migrations");
+
+  fs.existsSync = (target) => {
+    if (files === null && isMigrationDir(target)) return false;
+    if (files && isMigrationDir(target)) return true;
+
+    const fileName = path.basename(String(target));
+    if (files && Object.hasOwn(files, fileName)) return true;
+
+    return originalExistsSync(target);
+  };
+
+  fs.readdirSync = ((target: string, options?: any) => {
+    if (files && isMigrationDir(target)) {
+      return Object.keys(files);
+    }
+
+    return originalReaddirSync(target, options);
+  }) as any;
+
+  fs.readFileSync = (target, options) => {
+    const fileName = path.basename(String(target));
+    if (files && Object.hasOwn(files, fileName)) {
+      return files[fileName];
+    }
+
+    return originalReadFileSync(target, options);
+  };
+
+  try {
+    return fn();
+  } finally {
+    fs.existsSync = originalExistsSync;
+    fs.readdirSync = originalReaddirSync;
+    fs.readFileSync = originalReadFileSync;
+  }
+}
+
+function createDb() {
+  return new Database(":memory:");
+}
+
+test("migration 123 backfills account snapshots and creates its index", async () => {
+  const runner = await importFresh("src/lib/db/migrationRunner.ts");
+  const db = createDb();
+  const migrationSql = fs.readFileSync(
+    "src/lib/db/migrations/127_usage_history_account_identity.sql",
+    "utf8"
+  );
+
+  try {
+    db.exec(`
+      CREATE TABLE provider_connections (
+        id TEXT PRIMARY KEY,
+        provider TEXT,
+        auth_type TEXT,
+        name TEXT,
+        email TEXT,
+        display_name TEXT,
+        provider_specific_data TEXT
+      );
+      CREATE TABLE usage_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        provider TEXT,
+        connection_id TEXT,
+        account_key TEXT,
+        account_label TEXT,
+        account_label_priority INTEGER DEFAULT 0
+      );
+      INSERT INTO provider_connections
+        (id, provider, auth_type, email, provider_specific_data)
+      VALUES
+        ('empty-provider', '', 'oauth', 'member@example.com', '{"username":"member"}');
+      INSERT INTO usage_history (provider, connection_id)
+      VALUES ('codex', 'orphan-id'), ('', 'empty-provider');
+    `);
+
+    const count = withMockedMigrationFs(
+      { "127_usage_history_account_identity.sql": migrationSql },
+      () => runner.runMigrations(db)
+    );
+    const rows = db
+      .prepare("SELECT account_key, account_label FROM usage_history ORDER BY id")
+      .all();
+    const index = db
+      .prepare(
+        "SELECT name FROM sqlite_master WHERE type = 'index' AND name = 'idx_uh_account_key'"
+      )
+      .get();
+
+    assert.equal(count, 1);
+    assert.deepEqual(rows, [
+      {
+        account_key: '["connection","codex","orphan-id"]',
+        account_label: "orphan-id",
+      },
+      {
+        account_key: '["oauth","unknown","email","member@example.com","username","member"]',
+        account_label: "member@example.com",
+      },
+    ]);
+    assert.deepEqual(index, { name: "idx_uh_account_key" });
+  } finally {
+    db.close();
+  }
+});
+
+test("migration 123 preserves exact dedup identity and ignores non-string JSON scalars", async () => {
+  const runner = await importFresh("src/lib/db/migrationRunner.ts");
+  const db = createDb();
+  const sql = fs.readFileSync(
+    "src/lib/db/migrations/127_usage_history_account_identity.sql",
+    "utf8"
+  );
+
+  try {
+    db.exec(`
+      CREATE TABLE provider_connections (
+        id TEXT PRIMARY KEY,
+        provider TEXT,
+        auth_type TEXT,
+        name TEXT,
+        email TEXT,
+        display_name TEXT,
+        provider_specific_data TEXT
+      );
+      CREATE TABLE usage_history (
+        id INTEGER PRIMARY KEY AUTOINCREMENT,
+        provider TEXT,
+        connection_id TEXT,
+        account_key TEXT,
+        account_label TEXT,
+        account_label_priority INTEGER DEFAULT 0
+      );
+      INSERT INTO provider_connections
+        (id, provider, auth_type, email, provider_specific_data)
+      VALUES
+        ('generic', 'openai', 'oauth', ' Member@example.com ', '{"username":" Member "}'),
+        ('workspace', 'codex', 'oauth', ' Member@example.com ', '{"workspaceId":" Workspace "}'),
+        ('numeric-workspace', 'codex', 'oauth', 'member@example.com', '{"workspaceId":42}'),
+        ('object-user', 'codex', 'oauth', 'member@example.com', '{"chatgptUserId":{"id":"user-a"}}'),
+        ('array-username', 'openai', 'oauth', 'member@example.com', '{"username":["member"]}'),
+        ('malformed-json', 'openai', 'oauth', 'member@example.com', '{bad json');
+      INSERT INTO usage_history (provider, connection_id) VALUES
+        ('openai', 'generic'),
+        ('codex', 'workspace'),
+        ('codex', 'numeric-workspace'),
+        ('codex', 'object-user'),
+        ('openai', 'array-username'),
+        ('openai', 'malformed-json'),
+        ('', '');
+    `);
+
+    const count = withMockedMigrationFs({ "127_usage_history_account_identity.sql": sql }, () =>
+      runner.runMigrations(db)
+    );
+    const rows = db
+      .prepare("SELECT connection_id, account_key FROM usage_history ORDER BY id")
+      .all();
+
+    assert.equal(count, 1);
+    assert.deepEqual(rows, [
+      {
+        connection_id: "generic",
+        account_key: '["oauth","openai","email"," Member@example.com ","username"," Member "]',
+      },
+      {
+        connection_id: "workspace",
+        account_key: '["oauth","codex","workspace"," Workspace ","email"," Member@example.com "]',
+      },
+      {
+        connection_id: "numeric-workspace",
+        account_key: '["connection","codex","numeric-workspace"]',
+      },
+      {
+        connection_id: "object-user",
+        account_key: '["connection","codex","object-user"]',
+      },
+      {
+        connection_id: "array-username",
+        account_key: '["oauth","openai","email","member@example.com"]',
+      },
+      {
+        connection_id: "malformed-json",
+        account_key: '["oauth","openai","email","member@example.com"]',
+      },
+      {
+        connection_id: "",
+        account_key: '["connection","unknown","unknown"]',
+      },
+    ]);
+  } finally {
+    db.close();
+  }
+});
--- a/tests/unit/json-migration-combos.test.ts
+++ b/tests/unit/json-migration-combos.test.ts
@@ -18,6 +18,39 @@ test.after(() => {
  else process.env.DATA_DIR = ORIGINAL_DATA_DIR;
 });

+test("runJsonMigration preserves exported account snapshots after a connection was deleted", () => {
+  const db = core.getDbInstance();
+
+  runJsonMigration(db, {
+    usageHistory: [
+      {
+        id: 1,
+        provider: "codex",
+        model: "gpt-5.5",
+        connection_id: "deleted-codex-uuid",
+        account_key: '["oauth","codex","user","user-a","email","member@example.com"]',
+        account_label: "Production Codex",
+        account_label_priority: 4,
+        tokens_input: 10,
+        tokens_output: 5,
+        timestamp: "2026-01-01T00:00:00.000Z",
+      },
+    ],
+  });
+
+  const row = db
+    .prepare(
+      "SELECT account_key, account_label, account_label_priority FROM usage_history WHERE id = 1"
+    )
+    .get();
+
+  assert.deepEqual(row, {
+    account_key: '["oauth","codex","user","user-a","email","member@example.com"]',
+    account_label: "Production Codex",
+    account_label_priority: 4,
+  });
+});
+
 test("runJsonMigration normalizes legacy combo strategy names at the import boundary", () => {
  const db = core.getDbInstance();

--- a/tests/unit/usage-account-identity.test.ts
+++ b/tests/unit/usage-account-identity.test.ts
@@ -0,0 +1,27 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+
+const { resolveUsageAccountIdentity } = await import("../../src/lib/usage/accountIdentity.ts");
+
+test("Codex chatgptUserId identity is stable across UUID and label changes", () => {
+  const first = resolveUsageAccountIdentity({
+    id: "old-uuid",
+    provider: "codex",
+    authType: "oauth",
+    email: "member@example.com",
+    displayName: "Production Codex",
+    providerSpecificData: { chatgptUserId: "user-production" },
+  });
+  const recreated = resolveUsageAccountIdentity({
+    id: "new-uuid",
+    provider: "codex",
+    authType: "oauth",
+    email: "member@example.com",
+    name: "member@example.com",
+    providerSpecificData: { chatgptUserId: "user-production" },
+  });
+
+  assert.equal(first.accountKey, recreated.accountKey);
+  assert.equal(first.accountLabel, "Production Codex");
+  assert.equal(recreated.accountLabel, "member@example.com");
+});
--- a/tests/unit/usage-analytics-route-extra.test.ts
+++ b/tests/unit/usage-analytics-route-extra.test.ts
@@ -0,0 +1,558 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+const TEST_DATA_DIR = fs.mkdtempSync(
+  path.join(os.tmpdir(), "omniroute-usage-analytics-route-extra-")
+);
+process.env.DATA_DIR = TEST_DATA_DIR;
+const ORIGINAL_API_KEY_SECRET = process.env.API_KEY_SECRET;
+process.env.API_KEY_SECRET = "test-usage-analytics-secret";
+
+const core = await import("../../src/lib/db/core.ts");
+const localDb = await import("../../src/lib/localDb.ts");
+const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
+const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
+const analyticsRoute = await import("../../src/app/api/usage/analytics/route.ts");
+
+const clearPendingRequests = usageHistory.clearPendingRequests;
+const EXPECTED_TOTAL_COST = 0.020925;
+
+async function resetStorage() {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
+  clearPendingRequests();
+}
+
+async function seedAnalyticsData() {
+  const db = core.getDbInstance();
+  const now = new Date();
+  for (let i = 0; i < 20; i++) {
+    const timestamp = new Date(now.getTime() - i * 60 * 60 * 1000).toISOString();
+    db.prepare(
+      `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run(
+      i % 2 === 0 ? "openai" : "anthropic",
+      i % 2 === 0 ? "gpt-4o" : "claude-sonnet",
+      "test-conn",
+      "test-key",
+      "Primary Key",
+      100 + i,
+      50 + i,
+      1,
+      200 + i * 10,
+      timestamp
+    );
+  }
+  db.prepare(
+    `INSERT INTO call_logs (provider, model, requested_model, connection_id, timestamp)
+     VALUES (?, ?, ?, ?, ?)`
+  ).run("openai", "gpt-4o", "gpt-4o-mini", "test-conn", new Date().toISOString());
+}
+
+function makeRequest(url: string) {
+  return new Request(url, { method: "GET" });
+}
+
+function assertClose(actual: number, expected: number, epsilon = 0.000001) {
+  assert.ok(
+    Math.abs(actual - expected) <= epsilon,
+    `expected ${actual} to be within ${epsilon} of ${expected}`
+  );
+}
+
+test.beforeEach(async () => {
+  await resetStorage();
+  await localDb.updatePricing({
+    openai: { "gpt-4o": { input: 2.5, output: 10 } },
+    anthropic: { "claude-sonnet": { input: 3, output: 15 } },
+  });
+});
+
+test.after(() => {
+  core.resetDbInstance();
+  apiKeysDb.resetApiKeyState();
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+
+  if (ORIGINAL_API_KEY_SECRET === undefined) {
+    delete process.env.API_KEY_SECRET;
+  } else {
+    process.env.API_KEY_SECRET = ORIGINAL_API_KEY_SECRET;
+  }
+});
+test("GET /api/usage/analytics joins legacy workspace usage after Codex re-login", async () => {
+  await localDb.updatePricing({
+    codex: { "gpt-5.5": { input: 1, output: 2 } },
+  });
+
+  const db = core.getDbInstance();
+  const connectionId = "legacy-workspace-connection";
+  db.prepare(
+    `INSERT INTO provider_connections
+      (id, provider, auth_type, email, display_name, provider_specific_data, created_at, updated_at)
+     VALUES (?, 'codex', 'oauth', NULL, ?, ?, CURRENT_TIMESTAMP, CURRENT_TIMESTAMP)`
+  ).run(connectionId, "Production Codex", JSON.stringify({ workspaceId: "workspace-production" }));
+
+  await usageHistory.saveRequestUsage({
+    provider: "codex",
+    model: "gpt-5.5",
+    connectionId,
+    tokens: { input: 1000, output: 500 },
+    timestamp: "2026-01-01T00:00:00.000Z",
+  });
+
+  const relogged = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "member@example.com",
+    accessToken: "new-secret",
+    providerSpecificData: { workspaceId: "workspace-production" },
+  });
+  assert.equal(relogged.id, connectionId);
+  const repaired = db
+    .prepare(
+      "SELECT account_key, account_label, account_label_priority FROM usage_history WHERE connection_id = ?"
+    )
+    .get(connectionId);
+  assert.deepEqual(repaired, {
+    account_key:
+      '["oauth","codex","workspace","workspace-production","email","member@example.com"]',
+    account_label: "Production Codex",
+    account_label_priority: 4,
+  });
+
+  await usageHistory.saveRequestUsage({
+    provider: "codex",
+    model: "gpt-5.5",
+    connectionId,
+    tokens: { input: 1000, output: 500 },
+    timestamp: "2026-01-02T00:00:00.000Z",
+  });
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?startDate=2026-01-01T00:00:00.000Z")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.byAccount.length, 1);
+  assert.equal(body.byAccount[0].account, "Production Codex");
+  assert.equal(body.byAccount[0].requests, 2);
+  assertClose(body.byAccount[0].cost, 0.004);
+});
+
+test("GET /api/usage/analytics preserves a Codex account across deletion and re-login", async () => {
+  await localDb.updatePricing({
+    codex: { "gpt-5.5": { input: 1, output: 2 } },
+  });
+
+  const original = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "member@example.com",
+    displayName: "Production Codex",
+    accessToken: "old-secret",
+    providerSpecificData: { workspaceId: "workspace-production" },
+  });
+
+  await usageHistory.saveRequestUsage({
+    provider: "codex",
+    model: "gpt-5.5",
+    connectionId: original.id as string,
+    tokens: { input: 1000, output: 500 },
+    timestamp: "2026-01-01T00:00:00.000Z",
+  });
+  await providersDb.deleteProviderConnection(original.id as string);
+
+  const recreated = await providersDb.createProviderConnection({
+    provider: "codex",
+    authType: "oauth",
+    email: "member@example.com",
+    accessToken: "new-secret",
+    providerSpecificData: { workspaceId: "workspace-production" },
+  });
+  assert.notEqual(recreated.id, original.id);
+
+  await usageHistory.saveRequestUsage({
+    provider: "codex",
+    model: "gpt-5.5",
+    connectionId: recreated.id as string,
+    tokens: { input: 1000, output: 500 },
+    timestamp: "2026-01-02T00:00:00.000Z",
+  });
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?startDate=2026-01-01T00:00:00.000Z")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.byAccount.length, 1);
+  assert.equal(body.byAccount[0].account, "Production Codex");
+  assert.equal("accountKey" in body.byAccount[0], false);
+  assert.equal(body.byAccount[0].requests, 2);
+  assertClose(body.byAccount[0].cost, 0.004);
+});
+
+test("GET /api/usage/analytics keeps provider and Codex workspace account identities distinct", async () => {
+  const accountSpecs = [
+    { provider: "codex", workspaceId: "workspace-a" },
+    { provider: "codex", workspaceId: "workspace-b" },
+    { provider: "openai", workspaceId: undefined },
+  ];
+
+  for (const [index, spec] of accountSpecs.entries()) {
+    const connection = await providersDb.createProviderConnection({
+      provider: spec.provider,
+      authType: "oauth",
+      email: "shared@example.com",
+      accessToken: `secret-${index}`,
+      providerSpecificData: spec.workspaceId ? { workspaceId: spec.workspaceId } : {},
+    });
+    await usageHistory.saveRequestUsage({
+      provider: spec.provider,
+      model: spec.provider === "codex" ? "gpt-5.5" : "gpt-4o",
+      connectionId: connection.id as string,
+      tokens: { input: 100 + index, output: 50 + index },
+      timestamp: `2026-01-0${index + 1}T00:00:00.000Z`,
+    });
+  }
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?startDate=2026-01-01T00:00:00.000Z")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.byAccount.length, 3);
+  assert.ok(body.byAccount.every((row) => !("accountKey" in row)));
+  assert.deepEqual(body.byAccount.map((row) => row.account).sort(), [
+    "shared@example.com",
+    "shared@example.com",
+    "shared@example.com",
+  ]);
+});
+
+test("GET /api/usage/analytics keeps an honest UUID label for an orphaned legacy account", async () => {
+  const db = core.getDbInstance();
+  db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run("codex", "gpt-5.5", "deleted-legacy-uuid", 10, 5, 1, 25, "2026-01-01T00:00:00.000Z");
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?startDate=2026-01-01T00:00:00.000Z")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.byAccount.length, 1);
+  assert.equal(body.byAccount[0].account, "deleted-legacy-uuid");
+  assert.equal("accountKey" in body.byAccount[0], false);
+});
+
+test("GET /api/usage/analytics uses the newest equal-priority label for one account", async () => {
+  const db = core.getDbInstance();
+  const accountKey = '["oauth","codex","user","user-a","email","member@example.com"]';
+  const now = Date.now();
+  const insert = db.prepare(
+    `INSERT INTO usage_history
+      (provider, model, connection_id, account_key, account_label, account_label_priority,
+       tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  insert.run(
+    "codex",
+    "gpt-5.5",
+    "old-uuid",
+    accountKey,
+    "Zulu before rename",
+    4,
+    10,
+    5,
+    1,
+    20,
+    new Date(now - 60_000).toISOString()
+  );
+  insert.run(
+    "codex",
+    "gpt-5.5",
+    "new-uuid",
+    accountKey,
+    "Alpha after rename",
+    4,
+    20,
+    10,
+    1,
+    30,
+    new Date(now).toISOString()
+  );
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.summary.uniqueAccounts, 1);
+  assert.equal(body.byAccount.length, 1);
+  assert.equal(body.byAccount[0].account, "Alpha after rename");
+  assert.equal(body.byAccount[0].requests, 2);
+  assert.equal("accountKey" in body.byAccount[0], false);
+});
+
+test("GET /api/usage/analytics includes cost by API key", async () => {
+  await seedAnalyticsData();
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.ok(Array.isArray(body.byApiKey));
+  assert.equal(body.byApiKey.length, 1);
+  assert.equal(body.byApiKey[0].apiKeyId, "test-key");
+  assert.equal(body.byApiKey[0].apiKeyName, "Primary Key");
+  assertClose(body.byApiKey[0].cost, body.summary.totalCost);
+});
+
+test("GET /api/usage/analytics does not double-count raw and aggregated rows", async () => {
+  const db = core.getDbInstance();
+  const today = new Date();
+  const todayStr = today.toISOString().split("T")[0];
+  const cutoffDate = new Date();
+  cutoffDate.setDate(cutoffDate.getDate() - 30);
+  const olderDate = new Date(cutoffDate);
+  olderDate.setDate(olderDate.getDate() - 1);
+  const olderDateStr = olderDate.toISOString().split("T")[0];
+
+  db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run("openai", "gpt-4o", "raw-current", 100, 50, 1, 200, today.toISOString());
+
+  const insertSummary = db.prepare(
+    `INSERT INTO daily_usage_summary (provider, model, date, total_requests, total_input_tokens, total_output_tokens, total_cost)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  );
+  insertSummary.run("openai", "gpt-4o", todayStr, 99, 9900, 9900, 0);
+  insertSummary.run("openai", "gpt-4o", olderDateStr, 1, 25, 10, 0);
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?range=all")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.summary.totalRequests, 2);
+  assert.equal(body.summary.totalTokens, 185);
+  assert.equal(body.summary.uniqueAccounts, 1);
+});
+
+test("GET /api/usage/analytics omits global aggregates when filtering by API key", async () => {
+  const apiKey = await apiKeysDb.createApiKey("Scoped Key", "machine1234567890");
+  const db = core.getDbInstance();
+
+  db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "openai",
+    "gpt-4o",
+    "scoped-conn",
+    apiKey.id,
+    "Scoped Key",
+    100,
+    50,
+    1,
+    200,
+    new Date().toISOString()
+  );
+
+  db.prepare(
+    `INSERT INTO daily_usage_summary (provider, model, date, total_requests, total_input_tokens, total_output_tokens, total_cost)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  ).run("openai", "gpt-4o", "2024-01-01", 99, 9900, 9900, 0);
+
+  const response = await analyticsRoute.GET(
+    makeRequest(`http://localhost/api/usage/analytics?range=all&apiKeyIds=${apiKey.id}`)
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.summary.totalRequests, 1);
+  assert.equal(body.summary.totalTokens, 150);
+  assert.equal(body.byApiKey.length, 1);
+  assert.equal(body.byApiKey[0].apiKeyId, apiKey.id);
+});
+
+test("GET /api/usage/analytics groups renamed API key usage by stable ID", async () => {
+  const apiKey = await apiKeysDb.createApiKey("Averyanov", "machine1234567890");
+  await apiKeysDb.updateApiKeyPermissions(apiKey.id, { name: "Alexander Averyanov" });
+
+  const db = core.getDbInstance();
+  const now = Date.now();
+  const insertUsage = db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  );
+  insertUsage.run(
+    "openai",
+    "gpt-4o",
+    "test-conn",
+    apiKey.id,
+    "Averyanov",
+    100,
+    50,
+    1,
+    200,
+    new Date(now - 60_000).toISOString()
+  );
+  insertUsage.run(
+    "openai",
+    "gpt-4o",
+    "test-conn",
+    apiKey.id,
+    "Desktop",
+    200,
+    100,
+    1,
+    250,
+    new Date(now).toISOString()
+  );
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.summary.uniqueApiKeys, 1);
+  assert.equal(body.byApiKey.length, 1);
+  assert.equal(body.byApiKey[0].apiKeyId, apiKey.id);
+  assert.equal(body.byApiKey[0].apiKeyName, "Alexander Averyanov");
+  assert.deepEqual(body.byApiKey[0].historicalApiKeyNames.sort(), ["Averyanov", "Desktop"]);
+  assert.equal(body.byApiKey[0].requests, 2);
+  assert.equal(body.byApiKey[0].promptTokens, 300);
+  assert.equal(body.byApiKey[0].completionTokens, 150);
+
+  const filteredResponse = await analyticsRoute.GET(
+    makeRequest(`http://localhost/api/usage/analytics?apiKeyIds=${apiKey.id}`)
+  );
+  const filteredBody = await filteredResponse.json();
+
+  assert.equal(filteredResponse.status, 200);
+  assert.equal(filteredBody.summary.totalRequests, 2);
+  assert.equal(filteredBody.byApiKey.length, 1);
+  assert.equal(filteredBody.byApiKey[0].apiKeyId, apiKey.id);
+});
+
+test("GET /api/usage/analytics does not persist guessed API key attribution", async () => {
+  await localDb.updatePricing({
+    openai: { "gpt-4o": { input: 2.5, output: 10 } },
+  });
+  await apiKeysDb.createApiKey("Unrestricted Key", "machine1234567890");
+
+  const db = core.getDbInstance();
+  db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run("openai", "gpt-4o", "legacy-conn", null, null, 100, 50, 1, 200, new Date().toISOString());
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.byApiKey.length, 0);
+
+  const row = db
+    .prepare("SELECT api_key_id, api_key_name FROM usage_history WHERE connection_id = ?")
+    .get("legacy-conn") as { api_key_id: string | null; api_key_name: string | null };
+  assert.equal(row.api_key_id, null);
+  assert.equal(row.api_key_name, null);
+});
+
+test("GET /api/usage/analytics returns weeklyPattern for the costs dashboard", async () => {
+  await seedAnalyticsData();
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.ok(Array.isArray(body.weeklyPattern));
+  assert.equal(body.weeklyPattern.length, 7);
+  assert.deepEqual(
+    body.weeklyPattern.map((row) => row.day),
+    ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]
+  );
+  assert.ok(body.weeklyPattern.some((row) => row.totalTokens > 0 && row.avgTokens > 0));
+});
+
+test("GET /api/usage/analytics includes activityMap for heatmap", async () => {
+  await seedAnalyticsData();
+
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.ok(typeof body.activityMap === "object");
+  assert.ok(Object.keys(body.activityMap).length > 0);
+});
+
+test("GET /api/usage/analytics returns 500 on database errors", async () => {
+  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.ok(body.summary.totalRequests === 0);
+});
+
+test("GET /api/usage/analytics does not throw Unknown named parameter on short range (needsAggregated=false)", async () => {
+  // Regression: shared params object leaked agg-only bindings (@sinceDate, @rawCutoffDate)
+  // into queries that don't reference them, causing better-sqlite3 to throw.
+  // A short range (1h) triggers needsAggregated=false because the entire window
+  // falls within the raw-data-only period.
+  const db = core.getDbInstance();
+  const now = new Date();
+  db.prepare(
+    `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, timestamp)
+     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
+  ).run("openai", "gpt-4o", "test-conn", 100, 50, 1, 200, now.toISOString());
+
+  const response = await analyticsRoute.GET(
+    makeRequest("http://localhost/api/usage/analytics?range=1h")
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  assert.equal(body.summary.totalRequests, 1);
+});
+
+test("GET /api/usage/analytics does not throw Unknown named parameter with apiKey filter on long range", async () => {
+  // Regression: Object.assign(presetParams, params) leaked all main-query bindings
+  // into preset queries that only reference preset-prefixed placeholders.
+  const apiKey = await apiKeysDb.createApiKey("Preset Key", "machine-preset1234");
+  const db = core.getDbInstance();
+  const now = new Date();
+
+  // Seed data old enough to trigger aggregated + preset path
+  for (let i = 0; i < 5; i++) {
+    const ts = new Date(now.getTime() - (35 + i) * 24 * 60 * 60 * 1000).toISOString();
+    db.prepare(
+      `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
+       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
+    ).run("openai", "gpt-4o", "test-conn", apiKey.id, apiKey.name, 100, 50, 1, 200, ts);
+  }
+
+  const response = await analyticsRoute.GET(
+    makeRequest(`http://localhost/api/usage/analytics?range=60d&apiKeyId=${apiKey.id}`)
+  );
+  const body = await response.json();
+
+  assert.equal(response.status, 200);
+  // Core regression check: no "Unknown named parameter" error.
+  // The exact count depends on raw-vs-aggregated boundary; we only need to
+  // confirm the endpoint returns 200 without throwing.
+  assert.ok(typeof body.summary.totalRequests === "number");
+});
--- a/tests/unit/usage-analytics-route.test.ts
+++ b/tests/unit/usage-analytics-route.test.ts
@@ -12,6 +12,7 @@ process.env.API_KEY_SECRET = "test-usage-analytics-secret";
 const core = await import("../../src/lib/db/core.ts");
 const localDb = await import("../../src/lib/localDb.ts");
 const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
+const providersDb = await import("../../src/lib/db/providers.ts");
 const usageHistory = await import("../../src/lib/usage/usageHistory.ts");
 const analyticsRoute = await import("../../src/app/api/usage/analytics/route.ts");

@@ -324,258 +325,11 @@ test("GET /api/usage/analytics includes byAccount array with cost data", async (
  assert.equal(response.status, 200);
  assert.ok(Array.isArray(body.byAccount));
  assert.ok(body.byAccount.length > 0);
-  assert.equal(body.byAccount[0].account, "test-conn");
-  assert.equal(typeof body.byAccount[0].cost, "number");
-  assertClose(body.byAccount[0].cost, body.summary.totalCost);
+  assert.ok(body.byAccount.every((row) => row.account === "test-conn"));
+  assert.ok(body.byAccount.every((row) => typeof row.cost === "number"));
+  assertClose(
+    body.byAccount.reduce((sum, row) => sum + row.cost, 0),
+    body.summary.totalCost
+  );
 });

-test("GET /api/usage/analytics includes cost by API key", async () => {
-  await seedAnalyticsData();
-
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.ok(Array.isArray(body.byApiKey));
-  assert.equal(body.byApiKey.length, 1);
-  assert.equal(body.byApiKey[0].apiKeyId, "test-key");
-  assert.equal(body.byApiKey[0].apiKeyName, "Primary Key");
-  assertClose(body.byApiKey[0].cost, body.summary.totalCost);
-});
-
-test("GET /api/usage/analytics does not double-count raw and aggregated rows", async () => {
-  const db = core.getDbInstance();
-  const today = new Date();
-  const todayStr = today.toISOString().split("T")[0];
-  const cutoffDate = new Date();
-  cutoffDate.setDate(cutoffDate.getDate() - 30);
-  const olderDate = new Date(cutoffDate);
-  olderDate.setDate(olderDate.getDate() - 1);
-  const olderDateStr = olderDate.toISOString().split("T")[0];
-
-  db.prepare(
-    `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, timestamp)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run("openai", "gpt-4o", "raw-current", 100, 50, 1, 200, today.toISOString());
-
-  const insertSummary = db.prepare(
-    `INSERT INTO daily_usage_summary (provider, model, date, total_requests, total_input_tokens, total_output_tokens, total_cost)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`
-  );
-  insertSummary.run("openai", "gpt-4o", todayStr, 99, 9900, 9900, 0);
-  insertSummary.run("openai", "gpt-4o", olderDateStr, 1, 25, 10, 0);
-
-  const response = await analyticsRoute.GET(
-    makeRequest("http://localhost/api/usage/analytics?range=all")
-  );
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.equal(body.summary.totalRequests, 2);
-  assert.equal(body.summary.totalTokens, 185);
-});
-
-test("GET /api/usage/analytics omits global aggregates when filtering by API key", async () => {
-  const apiKey = await apiKeysDb.createApiKey("Scoped Key", "machine1234567890");
-  const db = core.getDbInstance();
-
-  db.prepare(
-    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run(
-    "openai",
-    "gpt-4o",
-    "scoped-conn",
-    apiKey.id,
-    "Scoped Key",
-    100,
-    50,
-    1,
-    200,
-    new Date().toISOString()
-  );
-
-  db.prepare(
-    `INSERT INTO daily_usage_summary (provider, model, date, total_requests, total_input_tokens, total_output_tokens, total_cost)
-     VALUES (?, ?, ?, ?, ?, ?, ?)`
-  ).run("openai", "gpt-4o", "2024-01-01", 99, 9900, 9900, 0);
-
-  const response = await analyticsRoute.GET(
-    makeRequest(`http://localhost/api/usage/analytics?range=all&apiKeyIds=${apiKey.id}`)
-  );
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.equal(body.summary.totalRequests, 1);
-  assert.equal(body.summary.totalTokens, 150);
-  assert.equal(body.byApiKey.length, 1);
-  assert.equal(body.byApiKey[0].apiKeyId, apiKey.id);
-});
-
-test("GET /api/usage/analytics groups renamed API key usage by stable ID", async () => {
-  const apiKey = await apiKeysDb.createApiKey("Averyanov", "machine1234567890");
-  await apiKeysDb.updateApiKeyPermissions(apiKey.id, { name: "Alexander Averyanov" });
-
-  const db = core.getDbInstance();
-  const now = Date.now();
-  const insertUsage = db.prepare(
-    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  );
-  insertUsage.run(
-    "openai",
-    "gpt-4o",
-    "test-conn",
-    apiKey.id,
-    "Averyanov",
-    100,
-    50,
-    1,
-    200,
-    new Date(now - 60_000).toISOString()
-  );
-  insertUsage.run(
-    "openai",
-    "gpt-4o",
-    "test-conn",
-    apiKey.id,
-    "Desktop",
-    200,
-    100,
-    1,
-    250,
-    new Date(now).toISOString()
-  );
-
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.equal(body.summary.uniqueApiKeys, 1);
-  assert.equal(body.byApiKey.length, 1);
-  assert.equal(body.byApiKey[0].apiKeyId, apiKey.id);
-  assert.equal(body.byApiKey[0].apiKeyName, "Alexander Averyanov");
-  assert.deepEqual(body.byApiKey[0].historicalApiKeyNames.sort(), ["Averyanov", "Desktop"]);
-  assert.equal(body.byApiKey[0].requests, 2);
-  assert.equal(body.byApiKey[0].promptTokens, 300);
-  assert.equal(body.byApiKey[0].completionTokens, 150);
-
-  const filteredResponse = await analyticsRoute.GET(
-    makeRequest(`http://localhost/api/usage/analytics?apiKeyIds=${apiKey.id}`)
-  );
-  const filteredBody = await filteredResponse.json();
-
-  assert.equal(filteredResponse.status, 200);
-  assert.equal(filteredBody.summary.totalRequests, 2);
-  assert.equal(filteredBody.byApiKey.length, 1);
-  assert.equal(filteredBody.byApiKey[0].apiKeyId, apiKey.id);
-});
-
-test("GET /api/usage/analytics does not persist guessed API key attribution", async () => {
-  await localDb.updatePricing({
-    openai: { "gpt-4o": { input: 2.5, output: 10 } },
-  });
-  await apiKeysDb.createApiKey("Unrestricted Key", "machine1234567890");
-
-  const db = core.getDbInstance();
-  db.prepare(
-    `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run("openai", "gpt-4o", "legacy-conn", null, null, 100, 50, 1, 200, new Date().toISOString());
-
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.equal(body.byApiKey.length, 0);
-
-  const row = db
-    .prepare("SELECT api_key_id, api_key_name FROM usage_history WHERE connection_id = ?")
-    .get("legacy-conn") as { api_key_id: string | null; api_key_name: string | null };
-  assert.equal(row.api_key_id, null);
-  assert.equal(row.api_key_name, null);
-});
-
-test("GET /api/usage/analytics returns weeklyPattern for the costs dashboard", async () => {
-  await seedAnalyticsData();
-
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.ok(Array.isArray(body.weeklyPattern));
-  assert.equal(body.weeklyPattern.length, 7);
-  assert.deepEqual(
-    body.weeklyPattern.map((row) => row.day),
-    ["Sun", "Mon", "Tue", "Wed", "Thu", "Fri", "Sat"]
-  );
-  assert.ok(body.weeklyPattern.some((row) => row.totalTokens > 0 && row.avgTokens > 0));
-});
-
-test("GET /api/usage/analytics includes activityMap for heatmap", async () => {
-  await seedAnalyticsData();
-
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.ok(typeof body.activityMap === "object");
-  assert.ok(Object.keys(body.activityMap).length > 0);
-});
-
-test("GET /api/usage/analytics returns 500 on database errors", async () => {
-  const response = await analyticsRoute.GET(makeRequest("http://localhost/api/usage/analytics"));
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.ok(body.summary.totalRequests === 0);
-});
-
-test("GET /api/usage/analytics does not throw Unknown named parameter on short range (needsAggregated=false)", async () => {
-  // Regression: shared params object leaked agg-only bindings (@sinceDate, @rawCutoffDate)
-  // into queries that don't reference them, causing better-sqlite3 to throw.
-  // A short range (1h) triggers needsAggregated=false because the entire window
-  // falls within the raw-data-only period.
-  const db = core.getDbInstance();
-  const now = new Date();
-  db.prepare(
-    `INSERT INTO usage_history (provider, model, connection_id, tokens_input, tokens_output, success, latency_ms, timestamp)
-     VALUES (?, ?, ?, ?, ?, ?, ?, ?)`
-  ).run("openai", "gpt-4o", "test-conn", 100, 50, 1, 200, now.toISOString());
-
-  const response = await analyticsRoute.GET(
-    makeRequest("http://localhost/api/usage/analytics?range=1h")
-  );
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  assert.equal(body.summary.totalRequests, 1);
-});
-
-test("GET /api/usage/analytics does not throw Unknown named parameter with apiKey filter on long range", async () => {
-  // Regression: Object.assign(presetParams, params) leaked all main-query bindings
-  // into preset queries that only reference preset-prefixed placeholders.
-  const apiKey = await apiKeysDb.createApiKey("Preset Key", "machine-preset1234");
-  const db = core.getDbInstance();
-  const now = new Date();
-
-  // Seed data old enough to trigger aggregated + preset path
-  for (let i = 0; i < 5; i++) {
-    const ts = new Date(now.getTime() - (35 + i) * 24 * 60 * 60 * 1000).toISOString();
-    db.prepare(
-      `INSERT INTO usage_history (provider, model, connection_id, api_key_id, api_key_name, tokens_input, tokens_output, success, latency_ms, timestamp)
-       VALUES (?, ?, ?, ?, ?, ?, ?, ?, ?, ?)`
-    ).run("openai", "gpt-4o", "test-conn", apiKey.id, apiKey.name, 100, 50, 1, 200, ts);
-  }
-
-  const response = await analyticsRoute.GET(
-    makeRequest(`http://localhost/api/usage/analytics?range=60d&apiKeyId=${apiKey.id}`)
-  );
-  const body = await response.json();
-
-  assert.equal(response.status, 200);
-  // Core regression check: no "Unknown named parameter" error.
-  // The exact count depends on raw-vs-aggregated boundary; we only need to
-  // confirm the endpoint returns 200 without throwing.
-  assert.ok(typeof body.summary.totalRequests === "number");
-});
--- a/tests/unit/usage-migrations.test.ts
+++ b/tests/unit/usage-migrations.test.ts
@@ -45,6 +45,7 @@ function resetDbTables() {
  const db = getDbInstance();
  db.prepare("DELETE FROM usage_history").run();
  db.prepare("DELETE FROM call_logs").run();
+  db.prepare("DELETE FROM provider_connections").run();
 }

 function readJson(filePath) {
@@ -139,7 +140,22 @@ test("migrateLegacyUsageFiles copies legacy JSON files once and does not overwri
  assert.deepEqual(readJson(CALL_LOGS_JSON_FILE), { logs: [{ id: "current-call" }] });
 });

-test("migrateUsageJsonToSqlite migrates usage history aliases and TTFT fallbacks", () => {
+test("migrateUsageJsonToSqlite migrates usage history aliases, TTFT, and account snapshots", () => {
+  const db = getDbInstance();
+  db.prepare(
+    `INSERT INTO provider_connections
+      (id, provider, auth_type, email, provider_specific_data, created_at, updated_at)
+     VALUES (?, ?, ?, ?, ?, ?, ?)`
+  ).run(
+    "conn-openai",
+    "openai",
+    "oauth",
+    "member@example.com",
+    JSON.stringify({ username: "member" }),
+    "2026-01-01T00:00:00.000Z",
+    "2026-01-01T00:00:00.000Z"
+  );
+
  writeJson(USAGE_JSON_FILE, {
    history: [
      {
@@ -182,13 +198,13 @@ test("migrateUsageJsonToSqlite migrates usage history aliases and TTFT fallbacks

  assert.equal(fs.existsSync(`${USAGE_JSON_FILE}.migrated`), true);

-  const db = getDbInstance();
  const rows = db
    .prepare(
      `
-        SELECT provider, model, connection_id, api_key_id, api_key_name,
-               tokens_input, tokens_output, tokens_cache_read, tokens_cache_creation,
-               tokens_reasoning, status, success, latency_ms, ttft_ms, error_code
+        SELECT provider, model, connection_id, account_key, account_label,
+               account_label_priority, api_key_id, api_key_name, tokens_input, tokens_output,
+               tokens_cache_read, tokens_cache_creation, tokens_reasoning, status, success,
+               latency_ms, ttft_ms, error_code
        FROM usage_history
        ORDER BY timestamp ASC
      `
@@ -201,6 +217,9 @@ test("migrateUsageJsonToSqlite migrates usage history aliases and TTFT fallbacks
      provider: "openai",
      model: "gpt-4o-mini",
      connection_id: "conn-openai",
+      account_key: '["oauth","openai","email","member@example.com","username","member"]',
+      account_label: "member@example.com",
+      account_label_priority: 3,
      api_key_id: "key-1",
      api_key_name: "Primary Key",
      tokens_input: 11,
@@ -218,6 +237,9 @@ test("migrateUsageJsonToSqlite migrates usage history aliases and TTFT fallbacks
      provider: "gemini",
      model: "gemini-2.5-flash",
      connection_id: null,
+      account_key: '["connection","gemini","unknown"]',
+      account_label: "unknown",
+      account_label_priority: 0,
      api_key_id: null,
      api_key_name: null,
      tokens_input: 9,