refactor: 大规模模块拆分与重组，新增 aether-admin crate

- 新建独立 aether-admin crate 承载 admin 相关共享契约与纯辅助函数
- 拆分 ai_pipeline 下 kiro/private_envelope/conversion/planner 等大文件为子模块目录
- 重组 admin handlers 各业务域（billing/oauth/provider/system/users 等）为目录结构，移除 shared.rs/builders.rs 等反模式
- 移除 ai_pipeline runtime adapters 旧实现（claude/openai/gemini/kiro/vertex/antigravity 等），改由 provider transport 统一承载
- 移除 control_facade/execution_facade/auth_snapshot_facade 等冗余 facade 层
- 拆分 query/billing 与 query/monitoring 模块、state/runtime/payments 与 security 模块
- 扩展架构测试覆盖 admin_billing/admin_model/admin_users 等新模块
- 删除 docs/architecture/refactor-execution-plan.md 已完成的执行计划文档

crates/aether-ai-pipeline/src/planner/common.rs

@@ -21,9 +21,19 @@ pub fn parse_direct_request_body(
     }
 }
 
+pub fn force_upstream_streaming_for_provider(
+    provider_type: &str,
+    provider_api_format: &str,
+) -> bool {
+    provider_type.trim().eq_ignore_ascii_case("codex")
+        && provider_api_format
+            .trim()
+            .eq_ignore_ascii_case("openai:cli")
+}
+
 #[cfg(test)]
 mod tests {
-    use super::parse_direct_request_body;
+    use super::{force_upstream_streaming_for_provider, parse_direct_request_body};
 
     #[test]
     fn parses_empty_json_body_as_empty_object() {
@@ -45,4 +55,21 @@ mod tests {
             Some((serde_json::json!({}), Some("aGVsbG8=".to_string())))
         );
     }
+
+    #[test]
+    fn forces_streaming_for_codex_openai_cli() {
+        assert!(force_upstream_streaming_for_provider("codex", "openai:cli"));
+    }
+
+    #[test]
+    fn does_not_force_streaming_for_compact_or_other_provider_types() {
+        assert!(!force_upstream_streaming_for_provider(
+            "codex",
+            "openai:compact"
+        ));
+        assert!(!force_upstream_streaming_for_provider(
+            "openai",
+            "openai:cli"
+        ));
+    }
 }

crates/aether-ai-pipeline/src/planner/standard/codex.rs

@@ -0,0 +1,216 @@
+use std::collections::BTreeMap;
+use std::fmt::Write;
+
+use aether_provider_transport::body_rules_handle_path;
+use serde_json::{json, Value};
+use sha1::{Digest as Sha1Digest, Sha1};
+use sha2::Sha256;
+use uuid::Uuid;
+
+const CODEX_PROMPT_CACHE_NAMESPACE_VERSION: &str = "v3";
+const UUID_NAMESPACE_OID_BYTES: [u8; 16] = [
+    0x6b, 0xa7, 0xb8, 0x12, 0x9d, 0xad, 0x11, 0xd1, 0x80, 0xb4, 0x00, 0xc0, 0x4f, 0xd4, 0x30, 0xc8,
+];
+
+fn is_codex_openai_cli_request(provider_type: &str, provider_api_format: &str) -> bool {
+    provider_type.trim().eq_ignore_ascii_case("codex")
+        && matches!(
+            provider_api_format.trim().to_ascii_lowercase().as_str(),
+            "openai:cli" | "openai:compact"
+        )
+}
+
+fn build_stable_codex_prompt_cache_key(user_api_key_id: &str) -> Option<String> {
+    let normalized = user_api_key_id.trim();
+    if normalized.is_empty() {
+        return None;
+    }
+
+    let namespace = format!(
+        "aether:codex:prompt-cache:{CODEX_PROMPT_CACHE_NAMESPACE_VERSION}:user:{normalized}"
+    );
+    let mut hasher = Sha1::new();
+    hasher.update(UUID_NAMESPACE_OID_BYTES);
+    hasher.update(namespace.as_bytes());
+
+    let digest = hasher.finalize();
+    let mut bytes = [0u8; 16];
+    bytes.copy_from_slice(&digest[..16]);
+    bytes[6] = (bytes[6] & 0x0f) | 0x50;
+    bytes[8] = (bytes[8] & 0x3f) | 0x80;
+    Some(Uuid::from_bytes(bytes).to_string())
+}
+
+fn build_short_codex_header_id(seed: &str) -> Option<String> {
+    let normalized = seed.trim();
+    if normalized.is_empty() {
+        return None;
+    }
+
+    let digest = Sha256::digest(normalized.as_bytes());
+    let mut short_id = String::with_capacity(16);
+    for byte in digest.iter().take(8) {
+        let _ = write!(&mut short_id, "{byte:02x}");
+    }
+    Some(short_id)
+}
+
+fn header_map_has_non_empty_value(headers: &http::HeaderMap, header_name: &str) -> bool {
+    let target = header_name.trim().to_ascii_lowercase();
+    if target.is_empty() {
+        return false;
+    }
+
+    headers.iter().any(|(name, value)| {
+        if name.as_str().trim().to_ascii_lowercase() != target {
+            return false;
+        }
+        value
+            .to_str()
+            .ok()
+            .map(str::trim)
+            .map(|value| !value.is_empty())
+            .unwrap_or(false)
+    })
+}
+
+fn extract_codex_account_id(decrypted_auth_config_raw: Option<&str>) -> Option<String> {
+    let raw = decrypted_auth_config_raw?.trim();
+    if raw.is_empty() {
+        return None;
+    }
+
+    serde_json::from_str::<Value>(raw).ok().and_then(|value| {
+        value
+            .get("account_id")
+            .and_then(Value::as_str)
+            .map(str::trim)
+            .filter(|value| !value.is_empty())
+            .map(ToOwned::to_owned)
+    })
+}
+
+fn maybe_inject_codex_prompt_cache_key(
+    provider_request_body: &mut Value,
+    provider_type: &str,
+    provider_api_format: &str,
+    user_api_key_id: Option<&str>,
+) {
+    if !is_codex_openai_cli_request(provider_type, provider_api_format) {
+        return;
+    }
+
+    let Some(body_object) = provider_request_body.as_object_mut() else {
+        return;
+    };
+
+    let existing = body_object
+        .get("prompt_cache_key")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .unwrap_or_default();
+    if !existing.is_empty() {
+        return;
+    }
+
+    let Some(prompt_cache_key) = user_api_key_id.and_then(build_stable_codex_prompt_cache_key)
+    else {
+        return;
+    };
+
+    body_object.insert(
+        "prompt_cache_key".to_string(),
+        Value::String(prompt_cache_key),
+    );
+}
+
+pub fn apply_codex_openai_cli_special_body_edits(
+    provider_request_body: &mut Value,
+    provider_type: &str,
+    provider_api_format: &str,
+    body_rules: Option<&Value>,
+    user_api_key_id: Option<&str>,
+) {
+    if !is_codex_openai_cli_request(provider_type, provider_api_format) {
+        return;
+    }
+
+    let Some(body_object) = provider_request_body.as_object_mut() else {
+        return;
+    };
+
+    if !body_rules_handle_path(body_rules, "max_output_tokens") {
+        body_object.remove("max_output_tokens");
+    }
+    if !body_rules_handle_path(body_rules, "temperature") {
+        body_object.remove("temperature");
+    }
+    if !body_rules_handle_path(body_rules, "top_p") {
+        body_object.remove("top_p");
+    }
+    if !body_rules_handle_path(body_rules, "metadata") {
+        body_object.remove("metadata");
+    }
+    if !body_rules_handle_path(body_rules, "store") {
+        body_object.insert("store".to_string(), json!(false));
+    }
+    if !body_rules_handle_path(body_rules, "instructions")
+        && !body_object.contains_key("instructions")
+    {
+        body_object.insert("instructions".to_string(), json!("You are GPT-5."));
+    }
+
+    maybe_inject_codex_prompt_cache_key(
+        provider_request_body,
+        provider_type,
+        provider_api_format,
+        user_api_key_id,
+    );
+}
+
+pub fn apply_codex_openai_cli_special_headers(
+    provider_request_headers: &mut BTreeMap<String, String>,
+    provider_request_body: &Value,
+    original_headers: &http::HeaderMap,
+    provider_type: &str,
+    provider_api_format: &str,
+    request_id: Option<&str>,
+    decrypted_auth_config_raw: Option<&str>,
+) {
+    if !is_codex_openai_cli_request(provider_type, provider_api_format) {
+        return;
+    }
+
+    if let Some(account_id) = extract_codex_account_id(decrypted_auth_config_raw) {
+        provider_request_headers.insert("chatgpt-account-id".to_string(), account_id);
+    }
+    if !provider_request_headers
+        .get("x-client-request-id")
+        .map(|value| !value.trim().is_empty())
+        .unwrap_or(false)
+    {
+        if let Some(request_id) = request_id.map(str::trim).filter(|value| !value.is_empty()) {
+            provider_request_headers
+                .insert("x-client-request-id".to_string(), request_id.to_string());
+        }
+    }
+
+    let prompt_cache_key = provider_request_body
+        .get("prompt_cache_key")
+        .and_then(Value::as_str)
+        .map(str::trim)
+        .filter(|value| !value.is_empty());
+    let Some(short_id) = prompt_cache_key.and_then(build_short_codex_header_id) else {
+        return;
+    };
+
+    if !header_map_has_non_empty_value(original_headers, "session_id") {
+        provider_request_headers.insert("session_id".to_string(), short_id.clone());
+    }
+
+    if provider_api_format.trim().to_ascii_lowercase() != "openai:compact"
+        && !header_map_has_non_empty_value(original_headers, "conversation_id")
+    {
+        provider_request_headers.insert("conversation_id".to_string(), short_id);
+    }
+}

crates/aether-ai-pipeline/src/planner/standard/matrix.rs

@@ -1,3 +1,8 @@
+use aether_provider_transport::url::{
+    build_claude_messages_url, build_gemini_content_url, build_openai_chat_url,
+    build_openai_cli_url, build_passthrough_path_url,
+};
+use aether_provider_transport::{apply_local_body_rules, GatewayProviderTransportSnapshot};
 use serde_json::Value;
 
 use crate::conversion::request::{
@@ -7,25 +12,43 @@ use crate::conversion::request::{
     normalize_gemini_request_to_openai_chat_request,
     normalize_openai_cli_request_to_openai_chat_request,
 };
+
+use super::codex::apply_codex_openai_cli_special_body_edits;
+
 pub fn build_standard_request_body(
     body_json: &Value,
     client_api_format: &str,
     mapped_model: &str,
+    provider_type: &str,
     provider_api_format: &str,
     request_path: &str,
     upstream_is_stream: bool,
+    body_rules: Option<&Value>,
+    user_api_key_id: Option<&str>,
 ) -> Option<Value> {
     let canonical_request = normalize_standard_request_to_openai_chat_request(
         body_json,
         client_api_format,
         request_path,
     )?;
-    build_standard_request_body_from_canonical(
+    let mut provider_request_body = build_standard_request_body_from_canonical(
         &canonical_request,
         mapped_model,
         provider_api_format,
         upstream_is_stream,
-    )
+    )?;
+
+    if !apply_local_body_rules(&mut provider_request_body, body_rules, Some(body_json)) {
+        return None;
+    }
+    apply_codex_openai_cli_special_body_edits(
+        &mut provider_request_body,
+        provider_type,
+        provider_api_format,
+        body_rules,
+        user_api_key_id,
+    );
+    Some(provider_request_body)
 }
 
 pub fn build_standard_request_body_from_canonical(
@@ -82,6 +105,54 @@ pub fn normalize_standard_request_to_openai_chat_request(
     }
 }
 
+pub fn build_standard_upstream_url(
+    parts: &http::request::Parts,
+    transport: &GatewayProviderTransportSnapshot,
+    mapped_model: &str,
+    provider_api_format: &str,
+    upstream_is_stream: bool,
+) -> Option<String> {
+    let custom_path = transport
+        .endpoint
+        .custom_path
+        .as_deref()
+        .map(str::trim)
+        .filter(|value| !value.is_empty());
+
+    match custom_path {
+        Some(path) => {
+            build_passthrough_path_url(&transport.endpoint.base_url, path, parts.uri.query(), &[])
+        }
+        None => match provider_api_format.trim().to_ascii_lowercase().as_str() {
+            "openai:chat" => Some(build_openai_chat_url(
+                &transport.endpoint.base_url,
+                parts.uri.query(),
+            )),
+            "openai:cli" => Some(build_openai_cli_url(
+                &transport.endpoint.base_url,
+                parts.uri.query(),
+                false,
+            )),
+            "openai:compact" => Some(build_openai_cli_url(
+                &transport.endpoint.base_url,
+                parts.uri.query(),
+                true,
+            )),
+            "claude:chat" | "claude:cli" => Some(build_claude_messages_url(
+                &transport.endpoint.base_url,
+                parts.uri.query(),
+            )),
+            "gemini:chat" | "gemini:cli" => build_gemini_content_url(
+                &transport.endpoint.base_url,
+                mapped_model,
+                upstream_is_stream,
+                parts.uri.query(),
+            ),
+            _ => None,
+        },
+    }
+}
+
 fn build_openai_chat_request_body(
     body_json: &Value,
     mapped_model: &str,
@@ -123,9 +194,12 @@ mod tests {
             &request,
             "claude:chat",
             "gpt-5",
+            "openai",
             "openai:chat",
             "/v1/messages",
             false,
+            None,
+            None,
         )
         .expect("claude chat should convert to openai chat");
 
@@ -154,9 +228,12 @@ mod tests {
             &request,
             "gemini:chat",
             "claude-sonnet-4-5",
+            "anthropic",
             "claude:chat",
             "/v1beta/models/gemini-2.5-pro:generateContent",
             false,
+            None,
+            None,
         )
         .expect("gemini chat should convert to claude chat");
 
@@ -187,9 +264,12 @@ mod tests {
             &request,
             "claude:cli",
             "gemini-2.5-pro",
+            "google",
             "gemini:cli",
             "/v1/messages",
             false,
+            None,
+            None,
         )
         .expect("claude cli should convert to gemini cli");
 
@@ -241,9 +321,12 @@ mod tests {
             &request,
             "openai:cli",
             "gpt-5",
+            "openai",
             "openai:chat",
             "/v1/responses",
             false,
+            None,
+            None,
         )
         .expect("responses request should convert to chat completions");
 
@@ -307,9 +390,12 @@ mod tests {
             &request,
             "openai:chat",
             "gemini-2.5-pro",
+            "google",
             "gemini:chat",
             "/v1/chat/completions",
             false,
+            None,
+            None,
         )
         .expect("openai chat should convert to gemini");
 
@@ -356,9 +442,12 @@ mod tests {
             &request,
             "openai:chat",
             "claude-sonnet-4-5",
+            "anthropic",
             "claude:chat",
             "/v1/chat/completions",
             false,
+            None,
+            None,
         )
         .expect("openai chat should convert to claude");
 

crates/aether-ai-pipeline/src/planner/standard/mod.rs

@@ -1,12 +1,19 @@
 pub mod claude;
+pub mod codex;
 pub mod family;
 pub mod gemini;
 pub mod matrix;
 pub mod normalize;
 pub mod openai_cli;
 
+pub use codex::{
+    apply_codex_openai_cli_special_body_edits, apply_codex_openai_cli_special_headers,
+};
 pub use family::{LocalStandardSourceFamily, LocalStandardSourceMode, LocalStandardSpec};
-pub use matrix::{build_standard_request_body, normalize_standard_request_to_openai_chat_request};
+pub use matrix::{
+    build_standard_request_body, build_standard_upstream_url,
+    normalize_standard_request_to_openai_chat_request,
+};
 pub use normalize::{
     build_cross_format_openai_chat_request_body, build_cross_format_openai_cli_request_body,
     build_local_openai_chat_request_body, build_local_openai_cli_request_body,