fix(openai,oauth): 修复 resp_ ID 前缀转换和 token 失效误判为账号级 block

- OpenAI normalizer: resp_ 前缀 ID 规范化为 chatcmpl- 前缀，流式 tool_call index 增加 block_index 回落
- OAuth token: 提取 token 失效关键词为共享常量，token invalidated 不再被判定为账号级 block
- Codex refresher: 403 + token invalidated 标记为 OAUTH_EXPIRED，允许 refresh_token 恢复

src/core/api_format/conversion/normalizers/openai.py

@@ -66,6 +66,21 @@ from src.core.api_format.conversion.stream_state import StreamState
 from src.core.logger import logger
 
 
+def _normalize_chat_completion_id(raw_id: str) -> str:
+    """将非 chatcmpl- 前缀的 ID 规范化为 Chat Completions 格式。
+
+    OpenAI Chat Completions 响应的 id 约定使用 chatcmpl- 前缀，
+    当上游返回 Responses API 格式（resp_ 前缀）或其他格式时需要转换。
+    """
+    if not raw_id:
+        return "chatcmpl-unknown"
+    if raw_id.startswith("chatcmpl-"):
+        return raw_id
+    if raw_id.startswith("resp_"):
+        return "chatcmpl-" + raw_id[5:]
+    return raw_id
+
+
 class OpenAINormalizer(FormatNormalizer):
     # 新模式：ApiFamily + EndpointKind 的 signature key
     FORMAT_ID = "openai:chat"
@@ -450,7 +465,7 @@ class OpenAINormalizer(FormatNormalizer):
         # 优先使用用户请求的原始模型名，回退到上游返回的模型名
         model_name = requested_model if requested_model else internal.model
         out: dict[str, Any] = {
-            "id": internal.id or "chatcmpl-unknown",
+            "id": _normalize_chat_completion_id(internal.id or ""),
             "object": "chat.completion",
             "created": int(time.time()),
             "model": model_name,
@@ -728,7 +743,7 @@ class OpenAINormalizer(FormatNormalizer):
 
         def base_chunk(delta: dict[str, Any], finish_reason: str | None = None) -> dict[str, Any]:
             return {
-                "id": state.message_id or "chatcmpl-stream",
+                "id": _normalize_chat_completion_id(state.message_id or "chatcmpl-stream"),
                 "object": "chat.completion.chunk",
                 "created": int(time.time()),
                 "model": state.model or "",
@@ -772,7 +787,7 @@ class OpenAINormalizer(FormatNormalizer):
         if isinstance(event, ContentBlockStartEvent) and event.block_type == ContentType.TOOL_USE:
             tool_id = event.tool_id or ""
             tool_name = event.tool_name or ""
-            tool_index = self._ensure_tool_call_index(ss, tool_id)
+            tool_index = self._ensure_tool_call_index(ss, tool_id, event.block_index)
             out.append(
                 base_chunk(
                     {
@@ -839,7 +854,7 @@ class OpenAINormalizer(FormatNormalizer):
             return out
 
         if isinstance(event, ToolCallDeltaEvent):
-            tool_index = self._ensure_tool_call_index(ss, event.tool_id)
+            tool_index = self._ensure_tool_call_index(ss, event.tool_id, event.block_index)
             # 后续 delta 只需 index + function.arguments；id/type 仅在 ContentBlockStartEvent 首次发送
             tc_delta: dict[str, Any] = {
                 "index": tool_index,
@@ -1783,17 +1798,34 @@ class OpenAINormalizer(FormatNormalizer):
         ss["next_block_index"] = next_idx + 1
         return next_idx
 
-    def _ensure_tool_call_index(self, ss: dict[str, Any], tool_id: str) -> int:
-        mapping = ss.get("tool_id_to_index")
+    def _ensure_tool_call_index(
+        self, ss: dict[str, Any], tool_id: str, block_index: int | None = None
+    ) -> int:
+        mapping: dict[str, int] = ss.get("tool_id_to_index")  # type: ignore[assignment]
         if not isinstance(mapping, dict):
             mapping = {}
             ss["tool_id_to_index"] = mapping
             ss["next_tool_index"] = 0
 
-        if tool_id in mapping:
-            return int(mapping[tool_id])
+        # block_index -> tool_index 的辅助映射，用于 tool_id 丢失时回落
+        block_mapping: dict[int, int] = ss.get("block_to_tool_index")  # type: ignore[assignment]
+        if not isinstance(block_mapping, dict):
+            block_mapping = {}
+            ss["block_to_tool_index"] = block_mapping
 
+        # 优先用 tool_id 查找
+        if tool_id and tool_id in mapping:
+            return mapping[tool_id]
+
+        # tool_id 为空时，用 block_index 回落查找
+        if not tool_id and block_index is not None and block_index in block_mapping:
+            return block_mapping[block_index]
+
+        # 首次出现：分配新 index
         next_idx = int(ss.get("next_tool_index") or 0)
-        mapping[tool_id] = next_idx
+        if tool_id:
+            mapping[tool_id] = next_idx
+        if block_index is not None:
+            block_mapping[block_index] = next_idx
         ss["next_tool_index"] = next_idx + 1
         return next_idx

src/services/provider/oauth_token.py

@@ -31,12 +31,49 @@ from src.models.database import ProviderAPIKey
 # 其余 reason 属于 token 级别异常，成功刷新 token 后自动清除。
 OAUTH_ACCOUNT_BLOCK_PREFIX = "[ACCOUNT_BLOCK] "
 
+# 上游返回 "token 已失效" 语义的关键词（小写匹配）。
+# 被 codex_refresher 前向分类和 oauth_token 回溯清理共用。
+TOKEN_INVALIDATED_KEYWORDS: tuple[str, ...] = (
+    "authentication token has been invalidated",
+    "token has been invalidated",
+)
+
+# 回溯清理专用：历史写入的中文 reason 也需匹配
+_LEGACY_TOKEN_INVALID_KEYWORDS: tuple[str, ...] = (
+    *TOKEN_INVALIDATED_KEYWORDS,
+    "codex token 无效或已过期",
+)
+
+
+def looks_like_token_invalidated(message: str | None) -> bool:
+    """判断上游错误消息是否表示 access token 已失效/被轮换。"""
+    lowered = str(message or "").strip().lower()
+    return any(keyword in lowered for keyword in TOKEN_INVALIDATED_KEYWORDS)
+
+
+def _is_refresh_recoverable_account_block(reason: str | None) -> bool:
+    """历史兼容：部分 token 级异常曾被错误写成 [ACCOUNT_BLOCK]。
+
+    这类原因在手动刷新成功后应自动清除，否则前端会继续展示
+    "Token 失效/账号异常"，并阻止 Key 恢复调度。
+    """
+    if not reason:
+        return False
+    text = str(reason)
+    if not text.startswith(OAUTH_ACCOUNT_BLOCK_PREFIX):
+        return False
+    lowered = text[len(OAUTH_ACCOUNT_BLOCK_PREFIX) :].strip().lower()
+    return any(keyword in lowered for keyword in _LEGACY_TOKEN_INVALID_KEYWORDS)
+
 
 def is_account_level_block(reason: str | None) -> bool:
     """判断 oauth_invalid_reason 是否属于账号级别的 block（刷新 token 无法修复）。"""
     if not reason:
         return False
-    return str(reason).startswith(OAUTH_ACCOUNT_BLOCK_PREFIX)
+    text = str(reason)
+    return text.startswith(
+        OAUTH_ACCOUNT_BLOCK_PREFIX
+    ) and not _is_refresh_recoverable_account_block(text)
 
 
 @dataclass(frozen=True, slots=True)
@@ -116,4 +153,9 @@ async def resolve_oauth_access_token(
     )
 
 
-__all__ = ["OAuthAccessTokenResult", "resolve_oauth_access_token"]
+__all__ = [
+    "OAuthAccessTokenResult",
+    "TOKEN_INVALIDATED_KEYWORDS",
+    "looks_like_token_invalidated",
+    "resolve_oauth_access_token",
+]

src/services/provider_keys/quota_refresh/codex_refresher.py

@@ -15,6 +15,7 @@ from sqlalchemy.orm import Session
 from src.core.crypto import crypto_service
 from src.models.database import Provider, ProviderAPIKey, ProviderEndpoint
 from src.services.provider.auth import get_provider_auth
+from src.services.provider.oauth_token import looks_like_token_invalidated
 from src.services.provider.pool.account_state import (
     OAUTH_ACCOUNT_BLOCK_PREFIX,
     OAUTH_EXPIRED_PREFIX,
@@ -67,14 +68,6 @@ def _extract_error_message_from_response(response: httpx.Response) -> str:
     return text[:300] if text else ""
 
 
-def _looks_like_token_invalidated(message: str | None) -> bool:
-    lowered = str(message or "").strip().lower()
-    return (
-        "authentication token has been invalidated" in lowered
-        or "token has been invalidated" in lowered
-    )
-
-
 def _looks_like_account_deactivated(message: str | None) -> bool:
     lowered = str(message or "").strip().lower()
     return "account has been deactivated" in lowered or "account deactivated" in lowered
@@ -97,6 +90,12 @@ def _build_structured_invalid_reason(*, status_code: int, upstream_message: str
         detail = message or "OpenAI 账号已停用"
         return f"{OAUTH_ACCOUNT_BLOCK_PREFIX}{detail}"
 
+    # Codex 某些场景会返回 403，但语义仍是 access token 已失效/被轮换。
+    # 这类异常可通过 refresh_token 恢复，不应落成账号级 block。
+    if looks_like_token_invalidated(message):
+        detail = message or "Codex Token 无效或已过期"
+        return f"{OAUTH_EXPIRED_PREFIX}{detail}"
+
     if status_code == 401:
         detail = message or "Codex Token 无效或已过期 (401)"
         return f"{OAUTH_EXPIRED_PREFIX}{detail}"