Deploy 4770498 to Docker Space

.env.example

@@ -10,6 +10,10 @@ OPENAI_API_KEY=
 # 示例：https://api.openai.com/v1
 OPENAI_API_BASE_URL=
 
+# 可选：服务端到图片上游的全局 HTTP(S) 代理。仅影响服务端出站请求，不影响浏览器访问本服务。
+# 仅支持无认证、无路径、无查询参数和无片段的 http:// 或 https:// 根代理地址；不支持 SOCKS。
+# OPENAI_UPSTREAM_PROXY_URL=http://proxy.internal:8080
+
 # 可选：服务端多渠道多 key 配置。配置任意 OPENAI_CHANNEL_N_* 后，会优先于 OPENAI_API_KEY。
 # 页面右上角“API 设置”里手动填写的 API Key/API URL 仍然拥有最高优先级。
 #
@@ -41,6 +45,7 @@ OPENAI_API_BASE_URL=
 #   单渠道配置优先于 OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY，且不会扩大 REQUEST_MODES 白名单。
 #   未配置时默认顺序：images-non-stream、images-sse、responses-non-stream、responses-sse。
 # - FAILURE_COOLDOWN_MS 可选，覆盖该渠道失败后的冷却时间。
+# - PROXY_URL 可选，覆盖 OPENAI_UPSTREAM_PROXY_URL，仅用于该渠道的服务端上游请求。
 # - API Key 本身不要包含逗号。
 #
 # 示例：
@@ -50,6 +55,7 @@ OPENAI_API_BASE_URL=
 # OPENAI_CHANNEL_1_REQUEST_MODES=images-non-stream,images-sse
 # OPENAI_CHANNEL_1_REQUEST_MODE_PRIORITY=images-non-stream,images-sse
 # OPENAI_CHANNEL_1_FAILURE_COOLDOWN_MS=30000
+# OPENAI_CHANNEL_1_PROXY_URL=http://channel-proxy.internal:8080
 # OPENAI_CHANNEL_1_USER_AGENT=gpt-image-playground/customer
 # OPENAI_CHANNEL_1_UPSTREAM_HEADERS_JSON={"X-Custom-Client":"customer"}
 #

Dockerfile

@@ -3,6 +3,7 @@ WORKDIR /app
 RUN apk add --no-cache python3 make g++ pkgconfig
 COPY package.json package-lock.json ./
 COPY scripts/check-install-script-policy.mjs scripts/dependency-installation.mjs scripts/npm-install-policy.mjs scripts/node-gyp-local-headers.cjs ./scripts/
+COPY vendor/brace-expansion-compat ./vendor/brace-expansion-compat
 ENV NODE_OPTIONS=--require=/app/scripts/node-gyp-local-headers.cjs
 RUN npm run install-scripts:check && npm run npm-install-policy:check && npm ci --strict-allow-scripts && npm run dependencies:check
 ENV NODE_OPTIONS=

README.md

@@ -12,7 +12,7 @@ app_port: 4783
 本地 AI 图片创作工作台，面向中文内容运营、设计草图和自动化生图流程。支持 `gpt-image-2`、OpenAI 兼容图片接口、文生图、图生图、遮罩编辑、批量任务、历史复用、费用追踪和 Agent API。
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/7db5c07cd25ba69e829f2561814fec0a1a73e7e8/readme-images/interface.jpg?v=20260608-07b596b" alt="GPT Image Playground 界面" width="900"/>
+  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/4770498acf64bbcda373c6a220f5b5781cef6136/readme-images/interface.jpg?v=20260608-07b596b" alt="GPT Image Playground 界面" width="900"/>
 </p>
 
 ## 快速开始
@@ -83,13 +83,13 @@ start-windows.bat
 遮罩编辑示例：
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/7db5c07cd25ba69e829f2561814fec0a1a73e7e8/readme-images/mask-creation.jpg?v=20260608-07b596b" alt="遮罩创建" width="900"/>
+  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/4770498acf64bbcda373c6a220f5b5781cef6136/readme-images/mask-creation.jpg?v=20260608-07b596b" alt="遮罩创建" width="900"/>
 </p>
 
 历史与费用示例：
 
 <p align="center">
-  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/7db5c07cd25ba69e829f2561814fec0a1a73e7e8/readme-images/history.jpg?v=20260608-07b596b" alt="历史面板" width="900"/>
+  <img src="https://raw.githubusercontent.com/MisonL/gpt-image-playground-customer/4770498acf64bbcda373c6a220f5b5781cef6136/readme-images/history.jpg?v=20260608-07b596b" alt="历史面板" width="900"/>
 </p>
 
 ## 配置
@@ -99,6 +99,7 @@ start-windows.bat
 | 场景               | 变量                                                                                                | 说明                                                                                                                                                                                                                                                                                                                                                                                                               |
 | ------------------ | --------------------------------------------------------------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------ |
 | 默认上游           | `OPENAI_API_KEY`、`OPENAI_API_BASE_URL`                                                             | 服务端默认 OpenAI 或兼容接口配置。页面 `API 设置` 优先级更高。                                                                                                                                                                                                                                                                                                                                                     |
+| 上游代理           | `OPENAI_UPSTREAM_PROXY_URL`、`OPENAI_CHANNEL_N_PROXY_URL`                                           | 可选。只用于服务端到图片上游的出站请求；渠道级地址优先于全局地址。仅接受无认证、无路径、无查询参数和无片段的 `http://` / `https://` 根代理地址，不支持 SOCKS。运行态和 Agent 诊断只公开是否启用及协议，不公开代理主机或端口。 |
 | 页面访问码         | `APP_PASSWORD`                                                                                      | 设置后访问页面和受保护图片需要访问码。公网部署建议开启。                                                                                                                                                                                                                                                                                                                                                           |
 | Agent 鉴权         | `AGENT_API_TOKEN`                                                                                   | 设置后 `/api/agent/*` 需要 Bearer token。                                                                                                                                                                                                                                                                                                                                                                          |
 | Agent 公开地址     | `AGENT_PUBLIC_BASE_URL`                                                                             | OpenAPI `servers[0].url` 和 Agent artifact 分享外链使用的公网 base URL。                                                                                                                                                                                                                                                                                                                                           |
@@ -137,6 +138,18 @@ OPENAI_CHANNEL_3_API_KEYS=your-matsca-key
 OPENAI_CHANNEL_3_UPSTREAM_PROFILE=matsca
 ```
 
+服务端上游代理可按全局或渠道单独配置：
+
+```dotenv
+# 所有未单独覆盖的上游渠道使用此代理。
+OPENAI_UPSTREAM_PROXY_URL=http://proxy.internal:8080
+
+# 仅覆盖渠道 2，优先级高于全局代理。
+OPENAI_CHANNEL_2_PROXY_URL=https://channel-proxy.internal:8443
+```
+
+代理仅作用于服务端到上游的 OpenAI/兼容 API、上游 SSE、同源结果图下载、渠道恢复探测和 new-api 用量日志请求，不改变浏览器到本服务的连接，也不使用浏览器系统代理。代理 URL 只能是无认证的 `http://` 或 `https://` 根地址，不能包含 SOCKS 协议、用户名密码、路径、查询参数或片段。修改代理环境变量后必须重启服务或重新部署。`GET /api/runtime-capabilities`、Agent capabilities 和渠道健康诊断只显示 `configured` 与 `protocol`，不会返回代理主机或端口。
+
 优先级：
 
 ```text

docs/deployment/huggingface-space-free.md

@@ -157,12 +157,16 @@ AGENT_PUBLIC_BASE_URL=https://<user>-<space>.hf.space
 ```dotenv
 OPENAI_API_KEY=<your-api-key>
 OPENAI_API_BASE_URL=https://api.openai.com/v1
+# 可选：仅服务端到上游的无认证 HTTP(S) 代理。
+OPENAI_UPSTREAM_PROXY_URL=http://proxy.internal:8080
 APP_PASSWORD=<page-access-code>
 AGENT_API_TOKEN=<long-random-agent-token>
 ```
 
 `OPENAI_API_BASE_URL` 和 `OPENAI_CHANNEL_N_BASE_URL` 必须是无凭据、无查询参数和无片段的 `http` 或 `https` 绝对地址，通常以 `/v1` 结尾。公网 Space 推荐使用 `https` 上游；只有内网、专用代理或已确认的兼容渠道需要 `http` 时才配置 `http`。
 
+`OPENAI_UPSTREAM_PROXY_URL` 只影响 Space 服务端到上游 API 的出站连接，不影响用户浏览器访问 Space。它仅接受无认证、无路径、无查询参数和无片段的 `http://` 或 `https://` 根代理地址，不支持 SOCKS。多渠道部署可用 `OPENAI_CHANNEL_N_PROXY_URL` 覆盖全局代理，渠道级值优先。代理地址即使不含凭据也建议作为 Space Secret 管理；修改后需要重新启动或重新部署 Space。运行态和 Agent 诊断只公开是否配置及协议，不公开主机或端口。
+
 公网部署建议至少设置访问码 `APP_PASSWORD` 和 `AGENT_API_TOKEN`。如果不设置 `APP_PASSWORD`，任何人都可以打开网页并消耗服务端 API Key。
 
 如果要把这个 Space 当成客户可见的公网服务，`npm run doctor:hf-space` 的 `remote-secrets` 必须通过，且应同时看到 `APP_PASSWORD` 和 `AGENT_API_TOKEN` 已配置。没有这两个值时，只适合本地或受控内网试用，不适合直接给客户公开。
@@ -174,6 +178,8 @@ OPENAI_ROUTING_STRATEGY=round_robin
 OPENAI_CHANNEL_1_ID=official
 OPENAI_CHANNEL_1_BASE_URL=https://api.openai.com/v1
 OPENAI_CHANNEL_1_API_KEYS=<key-a>,<key-b>
+# 可选：仅覆盖此渠道的全局上游代理。
+OPENAI_CHANNEL_1_PROXY_URL=http://channel-proxy.internal:8080
 ```
 
 ## 手机网页使用

package-lock.json

@@ -32,11 +32,12 @@
         "next-themes": "^0.4.6",
         "openai": "^6.34.0",
         "pg": "^8.20.0",
-        "postcss": "^8.5.14",
+        "postcss": "^8.5.18",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "sharp": "^0.35.3",
-        "tailwind-merge": "^3.2.0"
+        "tailwind-merge": "^3.2.0",
+        "undici": "^7.21.0"
       },
       "devDependencies": {
         "@eslint/eslintrc": "^3",
@@ -48,6 +49,7 @@
         "@types/pg": "^8.20.0",
         "@types/react": "^19",
         "@types/react-dom": "^19",
+        "brace-expansion": "file:vendor/brace-expansion-compat",
         "eslint": "^9",
         "eslint-config-next": "^16.2.10",
         "happy-dom": "^20.10.6",
@@ -3131,6 +3133,72 @@
         "node": ">=14.0.0"
       }
     },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@emnapi/wasi-threads": "1.2.2",
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
+      "version": "1.11.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
+      "version": "1.2.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
+      "version": "1.1.4",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "@tybys/wasm-util": "^0.10.1"
+      },
+      "funding": {
+        "type": "github",
+        "url": "https://github.com/sponsors/Brooooooklyn"
+      },
+      "peerDependencies": {
+        "@emnapi/core": "^1.7.1",
+        "@emnapi/runtime": "^1.7.1"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
+      "version": "0.10.2",
+      "dev": true,
+      "inBundle": true,
+      "license": "MIT",
+      "optional": true,
+      "dependencies": {
+        "tslib": "^2.4.0"
+      }
+    },
+    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
+      "version": "2.8.1",
+      "dev": true,
+      "inBundle": true,
+      "license": "0BSD",
+      "optional": true
+    },
     "node_modules/@tailwindcss/oxide-win32-arm64-msvc": {
       "version": "4.3.3",
       "resolved": "https://registry.npmjs.org/@tailwindcss/oxide-win32-arm64-msvc/-/oxide-win32-arm64-msvc-4.3.3.tgz",
@@ -3220,6 +3288,22 @@
         }
       }
     },
+    "node_modules/@trivago/prettier-plugin-sort-imports/node_modules/minimatch": {
+      "version": "9.0.9",
+      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
+      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
+      "dev": true,
+      "license": "ISC",
+      "dependencies": {
+        "brace-expansion": "^2.0.2"
+      },
+      "engines": {
+        "node": ">=16 || 14 >=14.17"
+      },
+      "funding": {
+        "url": "https://github.com/sponsors/isaacs"
+      }
+    },
     "node_modules/@tybys/wasm-util": {
       "version": "0.9.0",
       "resolved": "https://registry.npmjs.org/@tybys/wasm-util/-/wasm-util-0.9.0.tgz",
@@ -3514,29 +3598,6 @@
         "typescript": ">=4.8.4 <6.1.0"
       }
     },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/balanced-match": {
-      "version": "4.0.4",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
-      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
-      "dev": true,
-      "license": "MIT",
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
-    "node_modules/@typescript-eslint/typescript-estree/node_modules/brace-expansion": {
-      "version": "5.0.7",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.7.tgz",
-      "integrity": "sha512-7oFy703dxfY3/NLxC1fh2SUCQ0H9rmAY+5EpDVfXjUTTs+HEwR2nYaqLv+GWcTsumwxPfiz6CzCNkwXwBUwqCA==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "balanced-match": "^4.0.2"
-      },
-      "engines": {
-        "node": "18 || 20 || >=22"
-      }
-    },
     "node_modules/@typescript-eslint/typescript-estree/node_modules/minimatch": {
       "version": "10.2.5",
       "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-10.2.5.tgz",
@@ -4134,11 +4195,14 @@
       }
     },
     "node_modules/balanced-match": {
-      "version": "1.0.2",
-      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-1.0.2.tgz",
-      "integrity": "sha512-3oSeUO0TMV67hN1AmbXsK4yaqU7tjiHlbxRDZOpH0KW9+CeX4bRAaX0Anxt0tx2MrpRpWwQaPwIlISEJhYU5Pw==",
+      "version": "4.0.4",
+      "resolved": "https://registry.npmjs.org/balanced-match/-/balanced-match-4.0.4.tgz",
+      "integrity": "sha512-BLrgEcRTwX2o6gGxGOCNyMvGSp35YofuYzw9h1IMTRmKqttAZZVU67bdb9Pr2vUHA8+j3i2tJfjO6C6+4myGTA==",
       "dev": true,
-      "license": "MIT"
+      "license": "MIT",
+      "engines": {
+        "node": "18 || 20 || >=22"
+      }
     },
     "node_modules/baseline-browser-mapping": {
       "version": "2.10.43",
@@ -4166,14 +4230,21 @@
       }
     },
     "node_modules/brace-expansion": {
-      "version": "1.1.16",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-1.1.16.tgz",
-      "integrity": "sha512-IDw48K2/2kRkg9LdJxurvq3lV3aBgq0REY89duEqFRthjlPdXHKMj7EnQOXVckxzgisinf3nHfrcE2FufFLXMw==",
+      "resolved": "vendor/brace-expansion-compat",
+      "link": true
+    },
+    "node_modules/brace-expansion-modern": {
+      "name": "brace-expansion",
+      "version": "5.0.8",
+      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-5.0.8.tgz",
+      "integrity": "sha512-JZyDyq3D4AUifKTPOB7DELf6XsB3WdPuNxCtob1vFXPsSXhdAiHBWJ/tJ8HAc9aH84BK+5JFZLNkJKx3G9kzQg==",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0",
-        "concat-map": "0.0.1"
+        "balanced-match": "^4.0.2"
+      },
+      "engines": {
+        "node": "20 || >=22"
       }
     },
     "node_modules/braces": {
@@ -4380,13 +4451,6 @@
       "dev": true,
       "license": "MIT"
     },
-    "node_modules/concat-map": {
-      "version": "0.0.1",
-      "resolved": "https://registry.npmjs.org/concat-map/-/concat-map-0.0.1.tgz",
-      "integrity": "sha512-/Srv4dswyQNBfohGpz9o6Yb3Gz3SrUDqBH5rTuhGR7ahtlbYKnVxw2bCFMRljaA7EXHaXZ8wsHdodFvbkhKmqg==",
-      "dev": true,
-      "license": "MIT"
-    },
     "node_modules/convert-source-map": {
       "version": "2.0.0",
       "resolved": "https://registry.npmjs.org/convert-source-map/-/convert-source-map-2.0.0.tgz",
@@ -6471,6 +6535,27 @@
         "lightningcss-win32-x64-msvc": "1.32.0"
       }
     },
+    "node_modules/lightningcss-android-arm64": {
+      "version": "1.32.0",
+      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
+      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
+      "cpu": [
+        "arm64"
+      ],
+      "dev": true,
+      "license": "MPL-2.0",
+      "optional": true,
+      "os": [
+        "android"
+      ],
+      "engines": {
+        "node": ">= 12.0.0"
+      },
+      "funding": {
+        "type": "opencollective",
+        "url": "https://opencollective.com/parcel"
+      }
+    },
     "node_modules/lightningcss-darwin-arm64": {
       "version": "1.32.0",
       "resolved": "https://registry.npmjs.org/lightningcss-darwin-arm64/-/lightningcss-darwin-arm64-1.32.0.tgz",
@@ -6697,6 +6782,13 @@
         "url": "https://github.com/sponsors/sindresorhus"
       }
     },
+    "node_modules/lodash-es": {
+      "version": "4.18.1",
+      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
+      "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/lodash.merge": {
       "version": "4.6.2",
       "resolved": "https://registry.npmjs.org/lodash.merge/-/lodash.merge-4.6.2.tgz",
@@ -6736,6 +6828,16 @@
         "react": "^16.5.1 || ^17.0.0 || ^18.0.0 || ^19.0.0"
       }
     },
+    "node_modules/magic-string": {
+      "version": "0.30.21",
+      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
+      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "@jridgewell/sourcemap-codec": "^1.5.5"
+      }
+    },
     "node_modules/math-intrinsics": {
       "version": "1.1.0",
       "resolved": "https://registry.npmjs.org/math-intrinsics/-/math-intrinsics-1.1.0.tgz",
@@ -6824,9 +6926,9 @@
       "license": "MIT"
     },
     "node_modules/nanoid": {
-      "version": "3.3.11",
-      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.11.tgz",
-      "integrity": "sha512-N8SpfPUnUp1bK+PMYW8qSWdl9U+wwNWI4QKxOYDy9JAro3WMX7p2OeVRF9v+347pnakNevPmiHhNmZ2HbFA76w==",
+      "version": "3.3.16",
+      "resolved": "https://registry.npmjs.org/nanoid/-/nanoid-3.3.16.tgz",
+      "integrity": "sha512-bzlKTyNJ7+LdGIIwy8ijFpIqEQIvafahV7eYykJ8Cvh42EdJeODoJ6gUJXpQJvej1BddH8OqTXZNE/KfbWAu8Q==",
       "funding": [
         {
           "type": "github",
@@ -6927,6 +7029,15 @@
         "react-dom": "^16.8 || ^17 || ^18 || ^19 || ^19.0.0-rc"
       }
     },
+    "node_modules/node-addon-api": {
+      "version": "8.9.0",
+      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.0.tgz",
+      "integrity": "sha512-ekZMeaaIzSQTSpr7X2X3iJM7lTzgnx8ahAG9pJfT/7+14mlEM8ZYQ9cgCDvSSRbReFK0oHli3WrZdCiRsgAT9Q==",
+      "license": "MIT",
+      "engines": {
+        "node": "^18 || ^20 || >= 21"
+      }
+    },
     "node_modules/node-releases": {
       "version": "2.0.51",
       "resolved": "https://registry.npmjs.org/node-releases/-/node-releases-2.0.51.tgz",
@@ -7162,6 +7273,23 @@
         "node": ">=6"
       }
     },
+    "node_modules/parse-imports-exports": {
+      "version": "0.2.4",
+      "resolved": "https://registry.npmjs.org/parse-imports-exports/-/parse-imports-exports-0.2.4.tgz",
+      "integrity": "sha512-4s6vd6dx1AotCx/RCI2m7t7GCh5bDRUtGNvRfHSP2wbBQdMi67pPe7mtzmgwcaQ8VKK/6IB7Glfyu3qdZJPybQ==",
+      "dev": true,
+      "license": "MIT",
+      "dependencies": {
+        "parse-statements": "1.0.11"
+      }
+    },
+    "node_modules/parse-statements": {
+      "version": "1.0.11",
+      "resolved": "https://registry.npmjs.org/parse-statements/-/parse-statements-1.0.11.tgz",
+      "integrity": "sha512-HlsyYdMBnbPQ9Jr/VgJ1YF4scnldvJpJxCVx6KgqPL4dxppsWrJHCIIxQXMJrqGnsRkNPATbeMJ8Yxu7JMsYcA==",
+      "dev": true,
+      "license": "MIT"
+    },
     "node_modules/path-exists": {
       "version": "4.0.0",
       "resolved": "https://registry.npmjs.org/path-exists/-/path-exists-4.0.0.tgz",
@@ -7308,9 +7436,9 @@
       }
     },
     "node_modules/postcss": {
-      "version": "8.5.14",
-      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.14.tgz",
-      "integrity": "sha512-SoSL4+OSEtR99LHFZQiJLkT59C5B1amGO1NzTwj7TT1qCUgUO6hxOvzkOYxD+vMrXBM3XJIKzokoERdqQq/Zmg==",
+      "version": "8.5.23",
+      "resolved": "https://registry.npmjs.org/postcss/-/postcss-8.5.23.tgz",
+      "integrity": "sha512-g50586zr4bZmwFiTlflMu8E0bDTb5I5gertgwAKmsdUlTQIhZtunzUlD1WSzwcVWPoAVpsrA6vlfCD7oXvRwgg==",
       "funding": [
         {
           "type": "opencollective",
@@ -7327,7 +7455,7 @@
       ],
       "license": "MIT",
       "dependencies": {
-        "nanoid": "^3.3.11",
+        "nanoid": "^3.3.16",
         "picocolors": "^1.1.1",
         "source-map-js": "^1.2.1"
       },
@@ -8534,6 +8662,15 @@
         "url": "https://github.com/sponsors/ljharb"
       }
     },
+    "node_modules/undici": {
+      "version": "7.29.0",
+      "resolved": "https://registry.npmjs.org/undici/-/undici-7.29.0.tgz",
+      "integrity": "sha512-IDxfleLmmbSskfWSUATiN1nfn2rDuvnMOqb5CWR92iIfojA0Ud+ulOAAEQ57LPr9rWmsreUyf5lwyao+7GNNVw==",
+      "license": "MIT",
+      "engines": {
+        "node": ">=20.18.1"
+      }
+    },
     "node_modules/undici-types": {
       "version": "6.19.8",
       "resolved": "https://registry.npmjs.org/undici-types/-/undici-types-6.19.8.tgz",
@@ -8856,160 +8993,16 @@
         "zod": "^3.25.0 || ^4.0.0"
       }
     },
-    "node_modules/@trivago/prettier-plugin-sort-imports/node_modules/brace-expansion": {
-      "version": "2.1.2",
-      "resolved": "https://registry.npmjs.org/brace-expansion/-/brace-expansion-2.1.2.tgz",
-      "integrity": "sha512-w5JZcKgdhDOgOwm8H+KgbosopHMuGcl6qbulwjtz3SM7I7P3yW1eAjzMPLrIE+NQ9vjgANKHWeMHnrT0OXW1oA==",
+    "vendor/brace-expansion-compat": {
+      "name": "brace-expansion",
+      "version": "5.0.8",
       "dev": true,
       "license": "MIT",
       "dependencies": {
-        "balanced-match": "^1.0.0"
-      }
-    },
-    "node_modules/@trivago/prettier-plugin-sort-imports/node_modules/minimatch": {
-      "version": "9.0.9",
-      "resolved": "https://registry.npmjs.org/minimatch/-/minimatch-9.0.9.tgz",
-      "integrity": "sha512-OBwBN9AL4dqmETlpS2zasx+vTeWclWzkblfZk7KTA5j3jeOONz/tRCnZomUyvNg83wL5Zv9Ss6HMJXAgL8R2Yg==",
-      "dev": true,
-      "license": "ISC",
-      "dependencies": {
-        "brace-expansion": "^2.0.2"
+        "brace-expansion-modern": "npm:brace-expansion@5.0.8"
       },
       "engines": {
-        "node": ">=16 || 14 >=14.17"
-      },
-      "funding": {
-        "url": "https://github.com/sponsors/isaacs"
-      }
-    },
-    "node_modules/lodash-es": {
-      "version": "4.18.1",
-      "resolved": "https://registry.npmjs.org/lodash-es/-/lodash-es-4.18.1.tgz",
-      "integrity": "sha512-J8xewKD/Gk22OZbhpOVSwcs60zhd95ESDwezOFuA3/099925PdHJ7OFHNTGtajL3AlZkykD32HykiMo+BIBI8A==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/parse-imports-exports": {
-      "version": "0.2.4",
-      "resolved": "https://registry.npmjs.org/parse-imports-exports/-/parse-imports-exports-0.2.4.tgz",
-      "integrity": "sha512-4s6vd6dx1AotCx/RCI2m7t7GCh5bDRUtGNvRfHSP2wbBQdMi67pPe7mtzmgwcaQ8VKK/6IB7Glfyu3qdZJPybQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "parse-statements": "1.0.11"
-      }
-    },
-    "node_modules/parse-statements": {
-      "version": "1.0.11",
-      "resolved": "https://registry.npmjs.org/parse-statements/-/parse-statements-1.0.11.tgz",
-      "integrity": "sha512-HlsyYdMBnbPQ9Jr/VgJ1YF4scnldvJpJxCVx6KgqPL4dxppsWrJHCIIxQXMJrqGnsRkNPATbeMJ8Yxu7JMsYcA==",
-      "dev": true,
-      "license": "MIT"
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/core": {
-      "version": "1.11.1",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@emnapi/wasi-threads": "1.2.2",
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/runtime": {
-      "version": "1.11.1",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@emnapi/wasi-threads": {
-      "version": "1.2.2",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@napi-rs/wasm-runtime": {
-      "version": "1.1.4",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "@tybys/wasm-util": "^0.10.1"
-      },
-      "funding": {
-        "type": "github",
-        "url": "https://github.com/sponsors/Brooooooklyn"
-      },
-      "peerDependencies": {
-        "@emnapi/core": "^1.7.1",
-        "@emnapi/runtime": "^1.7.1"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/@tybys/wasm-util": {
-      "version": "0.10.2",
-      "dev": true,
-      "inBundle": true,
-      "license": "MIT",
-      "optional": true,
-      "dependencies": {
-        "tslib": "^2.4.0"
-      }
-    },
-    "node_modules/@tailwindcss/oxide-wasm32-wasi/node_modules/tslib": {
-      "version": "2.8.1",
-      "dev": true,
-      "inBundle": true,
-      "license": "0BSD",
-      "optional": true
-    },
-    "node_modules/lightningcss-android-arm64": {
-      "version": "1.32.0",
-      "resolved": "https://registry.npmjs.org/lightningcss-android-arm64/-/lightningcss-android-arm64-1.32.0.tgz",
-      "integrity": "sha512-YK7/ClTt4kAK0vo6w3X+Pnm0D2cf2vPHbhOXdoNti1Ga0al1P4TBZhwjATvjNwLEBCnKvjJc2jQgHXH0NEwlAg==",
-      "cpu": [
-        "arm64"
-      ],
-      "dev": true,
-      "license": "MPL-2.0",
-      "optional": true,
-      "os": [
-        "android"
-      ],
-      "engines": {
-        "node": ">= 12.0.0"
-      },
-      "funding": {
-        "type": "opencollective",
-        "url": "https://opencollective.com/parcel"
-      }
-    },
-    "node_modules/magic-string": {
-      "version": "0.30.21",
-      "resolved": "https://registry.npmjs.org/magic-string/-/magic-string-0.30.21.tgz",
-      "integrity": "sha512-vd2F4YUyEXKGcLHoq+TEyCjxueSeHnFxyyjNp80yg0XV4vUhnDer/lvvlqM/arB5bXQN5K2/3oinyCRyx8T2CQ==",
-      "dev": true,
-      "license": "MIT",
-      "dependencies": {
-        "@jridgewell/sourcemap-codec": "^1.5.5"
-      }
-    },
-    "node_modules/node-addon-api": {
-      "version": "8.9.0",
-      "resolved": "https://registry.npmjs.org/node-addon-api/-/node-addon-api-8.9.0.tgz",
-      "integrity": "sha512-ekZMeaaIzSQTSpr7X2X3iJM7lTzgnx8ahAG9pJfT/7+14mlEM8ZYQ9cgCDvSSRbReFK0oHli3WrZdCiRsgAT9Q==",
-      "license": "MIT",
-      "engines": {
-        "node": "^18 || ^20 || >= 21"
+        "node": ">=20"
       }
     }
   }

package.json

@@ -67,11 +67,12 @@
         "next-themes": "^0.4.6",
         "openai": "^6.34.0",
         "pg": "^8.20.0",
-        "postcss": "^8.5.14",
+        "postcss": "^8.5.18",
         "react": "^19.0.0",
         "react-dom": "^19.0.0",
         "sharp": "^0.35.3",
-        "tailwind-merge": "^3.2.0"
+        "tailwind-merge": "^3.2.0",
+        "undici": "^7.21.0"
     },
     "devDependencies": {
         "@eslint/eslintrc": "^3",
@@ -83,6 +84,7 @@
         "@types/pg": "^8.20.0",
         "@types/react": "^19",
         "@types/react-dom": "^19",
+        "brace-expansion": "file:vendor/brace-expansion-compat",
         "eslint": "^9",
         "eslint-config-next": "^16.2.10",
         "happy-dom": "^20.10.6",
@@ -97,7 +99,8 @@
         "node": ">=22.15.0"
     },
     "overrides": {
-        "postcss": "^8.5.14",
+        "postcss": "^8.5.18",
+        "brace-expansion": "$brace-expansion",
         "sharp": "$sharp"
     }
 }

public/hf-space-deploy-marker.json

@@ -1,6 +1,6 @@
 {
   "schema_version": 1,
-  "local_sha": "7db5c07cd25ba69e829f2561814fec0a1a73e7e8",
-  "created_at": "2026-07-23T14:28:33.665Z",
-  "deploy_id": "e28ac5a2-35c9-4be8-a553-2f3632c02d2e"
+  "local_sha": "4770498acf64bbcda373c6a220f5b5781cef6136",
+  "created_at": "2026-07-25T04:50:43.340Z",
+  "deploy_id": "28984fcf-867f-419f-bc4c-22acd7ba92c9"
 }

scripts/agent-skill-scripts.test.mjs

@@ -4399,10 +4399,12 @@ describe('Agent skill script argument validation', () => {
         const apiReference = readFileSync(join(skillRoot, 'references/api.md'), 'utf8');
 
         assert.match(skillText, /必须优先运行本 Skill 内置 scripts\/generate-image\.mjs/);
+        assert.match(skillText, /scripts\/channel-capability-matrix\.mjs/);
         assert.match(skillText, /不要临时编写 Node\/Python\/shell 脚本、curl 命令或手写 fetch\/FormData/);
         assert.match(openAiYaml, /先选择并运行内置脚本/);
         assert.match(openAiYaml, /不要临时编写 API 调用脚本/);
         assert.match(apiReference, /先使用这些内置脚本/);
+        assert.match(apiReference, /scripts\/channel-capability-matrix\.mjs/);
         assert.match(apiReference, /不要临时编写 Node\/Python\/shell 脚本、curl 命令或手写 fetch\/FormData/);
     });
 

scripts/brace-expansion-compat.test.mjs

@@ -0,0 +1,35 @@
+import assert from 'node:assert/strict';
+import { createRequire } from 'node:module';
+import { test } from 'node:test';
+
+const require = createRequire(import.meta.url);
+
+test('brace expansion compatibility facade supports legacy CommonJS consumers', () => {
+    const braceExpansion = require('brace-expansion');
+
+    assert.equal(typeof braceExpansion, 'function');
+    assert.equal(typeof braceExpansion.expand, 'function');
+    assert.deepEqual(braceExpansion('image-{a,b}.png'), ['image-a.png', 'image-b.png']);
+    assert.deepEqual(braceExpansion.expand('image-{a,b}.png'), ['image-a.png', 'image-b.png']);
+});
+
+test('brace expansion compatibility facade supports current ESM consumers', async () => {
+    const braceExpansion = await import('brace-expansion');
+
+    assert.equal(typeof braceExpansion.default, 'function');
+    assert.equal(typeof braceExpansion.expand, 'function');
+    assert.ok(braceExpansion.EXPANSION_MAX > 0);
+    assert.deepEqual(braceExpansion.expand('image-{a,b}.png', { max: 1 }), ['image-a.png']);
+});
+
+test('brace expansion compatibility facade supports installed minimatch consumer versions', () => {
+    const legacyMinimatch = require('minimatch');
+    const sortImportsRequire = createRequire(require.resolve('@trivago/prettier-plugin-sort-imports/package.json'));
+    const typeScriptEstreeRequire = createRequire(require.resolve('@typescript-eslint/typescript-estree/package.json'));
+    const sortImportsMinimatch = sortImportsRequire('minimatch');
+    const typeScriptEstreeMinimatch = typeScriptEstreeRequire('minimatch');
+
+    assert.equal(legacyMinimatch('src/image.ts', 'src/*.{ts,tsx}'), true);
+    assert.equal(sortImportsMinimatch.minimatch('src/image.ts', 'src/*.{ts,tsx}'), true);
+    assert.equal(typeScriptEstreeMinimatch.minimatch('src/image.ts', 'src/*.{ts,tsx}'), true);
+});

scripts/channel-capability-matrix.test.mjs

@@ -0,0 +1,562 @@
+import assert from 'node:assert/strict';
+import { spawn } from 'node:child_process';
+import { existsSync, mkdtempSync, readFileSync, rmSync, statSync, writeFileSync } from 'node:fs';
+import { createServer } from 'node:http';
+import { tmpdir } from 'node:os';
+import { join } from 'node:path';
+import { describe, it } from 'node:test';
+import { fileURLToPath } from 'node:url';
+
+import {
+    FIXTURE_IMAGE_BASE64,
+    createFixtureServer
+} from './local-image-upstream-fixture.mjs';
+import {
+    buildChannelEnvConfig,
+    buildRedactedChannelEnvPreview
+} from '../skills/gpt-image-playground-agent/scripts/lib/channel-capability-matrix.mjs';
+
+const repoRoot = fileURLToPath(new URL('..', import.meta.url));
+const matrixScript = join(repoRoot, 'skills/gpt-image-playground-agent/scripts/channel-capability-matrix.mjs');
+const testApiKey = 'test-upstream-token';
+const testResponsesModel = 'gpt-5.4';
+
+describe('channel capability matrix Skill script', () => {
+    it('writes a private directly usable channel configuration after all modes pass', async () => {
+        const fixture = await startServer(createFixtureServer());
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-'));
+        const outputPath = join(tempRoot, 'channel.env');
+        try {
+            const result = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-id',
+                    'fixture-upstream',
+                    '--timeout-ms',
+                    '5000'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+
+            assert.equal(result.status, 0);
+            assert.equal(result.stderr.trim(), '');
+            assert.doesNotMatch(result.stdout, new RegExp(testApiKey));
+            const report = JSON.parse(result.stdout);
+            assert.equal(report.ok, true);
+            assert.deepEqual(report.matrix.passed, [
+                'images-non-stream',
+                'images-sse',
+                'responses-non-stream',
+                'responses-sse'
+            ]);
+            assert.deepEqual(report.matrix.failed, []);
+            assert.equal(report.configuration.ready, true);
+            assert.equal(report.write.written, true);
+            assert.deepEqual(report.configuration.env_preview, [
+                'OPENAI_CHANNEL_1_ID=fixture-upstream',
+                `OPENAI_CHANNEL_1_BASE_URL=${fixture.baseUrl}/v1`,
+                'OPENAI_CHANNEL_1_API_KEYS=[redacted]',
+                'OPENAI_CHANNEL_1_REQUEST_MODES=images-non-stream,images-sse,responses-non-stream,responses-sse',
+                'OPENAI_CHANNEL_1_REQUEST_MODE_PRIORITY=images-non-stream,images-sse,responses-non-stream,responses-sse',
+                'IMAGE_GENERATION_BACKEND=images-api',
+                'IMAGE_STREAMING_STRATEGY=auto',
+                'ENABLE_RESPONSES_IMAGE_BACKEND=true',
+                `OPENAI_RESPONSES_API_MODEL=${testResponsesModel}`
+            ]);
+
+            const content = readFileSync(outputPath, 'utf8');
+            assert.match(content, /OPENAI_CHANNEL_1_ID=fixture-upstream/);
+            assert.match(content, new RegExp(`OPENAI_CHANNEL_1_BASE_URL=${escapeRegExp(`${fixture.baseUrl}/v1`)}`));
+            assert.match(content, new RegExp(`OPENAI_CHANNEL_1_API_KEYS=${testApiKey}`));
+            assert.match(content, /OPENAI_CHANNEL_1_REQUEST_MODES=images-non-stream,images-sse,responses-non-stream,responses-sse/);
+            assert.match(content, /OPENAI_CHANNEL_1_REQUEST_MODE_PRIORITY=images-non-stream,images-sse,responses-non-stream,responses-sse/);
+            assert.match(content, /IMAGE_GENERATION_BACKEND=images-api/);
+            assert.match(content, /IMAGE_STREAMING_STRATEGY=auto/);
+            assert.match(content, /ENABLE_RESPONSES_IMAGE_BACKEND=true/);
+            assert.match(content, new RegExp(`OPENAI_RESPONSES_API_MODEL=${testResponsesModel}`));
+            assert.equal(statSync(outputPath).mode & 0o777, 0o600);
+
+            const resolvedConfig = await resolveGeneratedConfig(outputPath);
+            assert.equal(resolvedConfig.status, 0);
+            assert.equal(resolvedConfig.stderr.trim(), '');
+            assert.deepEqual(resolvedConfig.value, {
+                channel: {
+                    id: 'fixture-upstream',
+                    base_url: `${fixture.baseUrl}/v1`,
+                    request_modes: [
+                        'images-non-stream',
+                        'images-sse',
+                        'responses-non-stream',
+                        'responses-sse'
+                    ],
+                    request_mode_priority: [
+                        'images-non-stream',
+                        'images-sse',
+                        'responses-non-stream',
+                        'responses-sse'
+                    ]
+                },
+                image_backend: 'images-api',
+                streaming_strategy: 'auto'
+            });
+
+            const refused = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-id',
+                    'fixture-upstream',
+                    '--timeout-ms',
+                    '5000'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+            assert.equal(refused.status, 2);
+            assert.match(refused.stderr, /已存在/);
+            assert.equal(refused.stdout.trim(), '');
+
+            const overwritten = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-id',
+                    'fixture-upstream',
+                    '--timeout-ms',
+                    '5000',
+                    '--overwrite'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+            assert.equal(overwritten.status, 0);
+            assert.equal(JSON.parse(overwritten.stdout).write.written, true);
+            assert.equal(statSync(outputPath).mode & 0o777, 0o600);
+        } finally {
+            await fixture.close();
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+
+    it('writes only the verified Images API mode and preserves fixed probe order', async () => {
+        const calls = [];
+        const fixture = await startServer(
+            createServer(async (request, response) => {
+                const url = new URL(request.url || '/', 'http://fixture.local');
+                if (request.method === 'GET' && url.pathname === '/v1/models') {
+                    calls.push({ method: request.method, path: url.pathname });
+                    sendJson(response, 200, { data: [{ id: 'gpt-image-2' }, { id: testResponsesModel }] });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/images/generations') {
+                    const body = await readJsonBody(request);
+                    calls.push({ method: request.method, path: url.pathname, stream: body.stream === true });
+                    if (body.stream === true) {
+                        sendJson(response, 502, { error: { message: 'images sse unavailable' } });
+                        return;
+                    }
+                    sendJson(response, 200, { data: [{ b64_json: FIXTURE_IMAGE_BASE64 }] });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/responses') {
+                    const body = await readJsonBody(request);
+                    calls.push({ method: request.method, path: url.pathname, stream: body.stream === true });
+                    sendJson(response, 503, { error: { message: 'responses unavailable' } });
+                    return;
+                }
+                sendJson(response, 404, { error: { message: 'unknown route' } });
+            })
+        );
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-partial-'));
+        const outputPath = join(tempRoot, 'partial.env');
+        try {
+            const result = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-index',
+                    '2',
+                    '--channel-id',
+                    'images-only',
+                    '--timeout-ms',
+                    '5000'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+
+            assert.equal(result.status, 0);
+            const report = JSON.parse(result.stdout);
+            assert.deepEqual(report.matrix.passed, ['images-non-stream']);
+            assert.deepEqual(report.matrix.failed, ['images-sse', 'responses-non-stream', 'responses-sse']);
+            assert.equal(report.matrix.coverage_complete, true);
+            assert.equal(report.configuration.ready, true);
+            assert.equal(report.write.written, true);
+            assert.deepEqual(calls, [
+                { method: 'GET', path: '/v1/models' },
+                { method: 'POST', path: '/v1/images/generations', stream: false },
+                { method: 'POST', path: '/v1/images/generations', stream: true },
+                { method: 'POST', path: '/v1/responses', stream: false },
+                { method: 'POST', path: '/v1/responses', stream: true }
+            ]);
+
+            const content = readFileSync(outputPath, 'utf8');
+            assert.match(content, /OPENAI_CHANNEL_2_REQUEST_MODES=images-non-stream/);
+            assert.match(content, /OPENAI_CHANNEL_2_REQUEST_MODE_PRIORITY=images-non-stream/);
+            assert.match(content, /IMAGE_GENERATION_BACKEND=images-api/);
+            assert.match(content, /IMAGE_STREAMING_STRATEGY=auto/);
+            assert.doesNotMatch(content, /ENABLE_RESPONSES_IMAGE_BACKEND/);
+            assert.doesNotMatch(content, /OPENAI_RESPONSES_API_MODEL/);
+        } finally {
+            await fixture.close();
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+
+    it('selects the Responses backend when no Images API request mode is usable', async () => {
+        const calls = [];
+        const fixture = await startServer(
+            createServer(async (request, response) => {
+                const url = new URL(request.url || '/', 'http://fixture.local');
+                if (request.method === 'GET' && url.pathname === '/v1/models') {
+                    calls.push({ method: request.method, path: url.pathname });
+                    sendJson(response, 200, { data: [{ id: 'gpt-image-2' }, { id: testResponsesModel }] });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/images/generations') {
+                    const body = await readJsonBody(request);
+                    calls.push({ method: request.method, path: url.pathname, stream: body.stream === true });
+                    sendJson(response, 503, { error: { message: 'images unavailable' } });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/responses') {
+                    const body = await readJsonBody(request);
+                    calls.push({ method: request.method, path: url.pathname, stream: body.stream === true });
+                    if (body.stream === true) {
+                        sendJson(response, 503, { error: { message: 'responses sse unavailable' } });
+                        return;
+                    }
+                    sendJson(response, 200, {
+                        output: [
+                            {
+                                type: 'image_generation_call',
+                                status: 'completed',
+                                result: `data:image/png;base64,${FIXTURE_IMAGE_BASE64}`
+                            }
+                        ]
+                    });
+                    return;
+                }
+                sendJson(response, 404, { error: { message: 'unknown route' } });
+            })
+        );
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-responses-only-'));
+        const outputPath = join(tempRoot, 'responses-only.env');
+        try {
+            const result = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-index',
+                    '3',
+                    '--channel-id',
+                    'responses-only',
+                    '--timeout-ms',
+                    '5000'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+
+            assert.equal(result.status, 0);
+            const report = JSON.parse(result.stdout);
+            assert.deepEqual(report.matrix.passed, ['responses-non-stream']);
+            assert.deepEqual(report.matrix.failed, ['images-non-stream', 'images-sse', 'responses-sse']);
+            assert.equal(report.configuration.ready, true);
+            assert.equal(report.configuration.image_backend, 'responses-image-generation');
+            assert.equal(report.configuration.streaming_strategy, 'auto');
+            assert.equal(report.write.written, true);
+            assert.deepEqual(calls, [
+                { method: 'GET', path: '/v1/models' },
+                { method: 'POST', path: '/v1/images/generations', stream: false },
+                { method: 'POST', path: '/v1/images/generations', stream: true },
+                { method: 'POST', path: '/v1/responses', stream: false },
+                { method: 'POST', path: '/v1/responses', stream: true }
+            ]);
+
+            const content = readFileSync(outputPath, 'utf8');
+            assert.match(content, /OPENAI_CHANNEL_3_REQUEST_MODES=responses-non-stream/);
+            assert.match(content, /OPENAI_CHANNEL_3_REQUEST_MODE_PRIORITY=responses-non-stream/);
+            assert.match(content, /IMAGE_GENERATION_BACKEND=responses-image-generation/);
+            assert.match(content, /IMAGE_STREAMING_STRATEGY=auto/);
+            assert.match(content, /ENABLE_RESPONSES_IMAGE_BACKEND=true/);
+            assert.match(content, new RegExp(`OPENAI_RESPONSES_API_MODEL=${testResponsesModel}`));
+
+            const resolvedConfig = await resolveGeneratedConfig(outputPath);
+            assert.equal(resolvedConfig.status, 0);
+            assert.equal(resolvedConfig.stderr.trim(), '');
+            assert.equal(resolvedConfig.value.channel.id, 'responses-only');
+            assert.deepEqual(resolvedConfig.value.channel.request_modes, ['responses-non-stream']);
+            assert.equal(resolvedConfig.value.image_backend, 'responses-image-generation');
+            assert.equal(resolvedConfig.value.streaming_strategy, 'auto');
+        } finally {
+            await fixture.close();
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+
+    it('refuses a remote URL-only result and leaves the target absent', async () => {
+        const fixture = await startServer(
+            createServer(async (request, response) => {
+                const url = new URL(request.url || '/', 'http://fixture.local');
+                if (request.method === 'GET' && url.pathname === '/v1/models') {
+                    sendJson(response, 200, { data: [{ id: 'gpt-image-2' }, { id: testResponsesModel }] });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/images/generations') {
+                    await readJsonBody(request);
+                    sendJson(response, 200, { data: [{ url: 'https://cdn.example.test/generated.png' }] });
+                    return;
+                }
+                if (request.method === 'POST' && url.pathname === '/v1/responses') {
+                    await readJsonBody(request);
+                    sendJson(response, 503, { error: { message: 'responses unavailable' } });
+                    return;
+                }
+                sendJson(response, 404, { error: { message: 'unknown route' } });
+            })
+        );
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-remote-url-'));
+        const outputPath = join(tempRoot, 'remote-url.env');
+        try {
+            const result = await runMatrix(
+                [
+                    '--base-url',
+                    `${fixture.baseUrl}/v1`,
+                    '--responses-model',
+                    testResponsesModel,
+                    '--allow-billable',
+                    '--write-env-file',
+                    outputPath,
+                    '--channel-id',
+                    'remote-url-only',
+                    '--timeout-ms',
+                    '5000'
+                ],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+
+            assert.equal(result.status, 1);
+            assert.doesNotMatch(result.stdout, new RegExp(testApiKey));
+            const report = JSON.parse(result.stdout);
+            assert.deepEqual(report.matrix.passed, []);
+            assert.equal(report.matrix.modes['images-non-stream'].has_remote_url_result, true);
+            assert.equal(report.configuration.ready, false);
+            assert.deepEqual(report.configuration.blocking_reasons, ['no_consumable_image_mode']);
+            assert.equal(report.write.written, false);
+            assert.equal(report.write.reason, 'configuration_not_ready');
+            assert.equal(existsSync(outputPath), false);
+        } finally {
+            await fixture.close();
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+
+    it('requires explicit billable permission before it accepts a private output target', async () => {
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-non-billable-'));
+        const outputPath = join(tempRoot, 'unverified.env');
+        try {
+            const result = await runMatrix(
+                ['--base-url', 'http://127.0.0.1:9/v1', '--write-env-file', outputPath],
+                { GPT_IMAGE_UPSTREAM_API_KEY: testApiKey }
+            );
+
+            assert.equal(result.status, 2);
+            assert.match(result.stderr, /--allow-billable/);
+            assert.equal(result.stdout.trim(), '');
+            assert.equal(existsSync(outputPath), false);
+        } finally {
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+
+    it('includes the exact allowlist required for a remote plain HTTP upstream', async () => {
+        const baseUrl = 'http://images.internal.example.test/v1';
+        const config = buildChannelEnvConfig({
+            channelIndex: 4,
+            channelId: 'plain-http',
+            baseUrl,
+            apiKey: testApiKey,
+            requestModes: ['images-non-stream']
+        });
+        const preview = buildRedactedChannelEnvPreview({
+            channelIndex: 4,
+            channelId: 'plain-http',
+            baseUrl,
+            requestModes: ['images-non-stream']
+        });
+
+        assert.match(config, new RegExp(`OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS=${escapeRegExp(baseUrl)}`));
+        assert.ok(preview.includes(`OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS=${baseUrl}`));
+        assert.doesNotMatch(config, /OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS=http:\/\/127\.0\.0\.1/);
+
+        const tempRoot = mkdtempSync(join(tmpdir(), 'channel-capability-matrix-plain-http-'));
+        const outputPath = join(tempRoot, 'plain-http.env');
+        try {
+            writeFileSync(outputPath, config, { mode: 0o600 });
+            const resolvedConfig = await resolveGeneratedConfig(outputPath);
+            assert.equal(resolvedConfig.status, 0);
+            assert.equal(resolvedConfig.stderr.trim(), '');
+            assert.equal(resolvedConfig.value.channel.base_url, baseUrl);
+            assert.deepEqual(resolvedConfig.value.channel.request_modes, ['images-non-stream']);
+            assert.equal(resolvedConfig.value.image_backend, 'images-api');
+        } finally {
+            rmSync(tempRoot, { recursive: true, force: true });
+        }
+    });
+});
+
+async function startServer(server) {
+    await new Promise((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    assert.ok(address && typeof address === 'object');
+    return {
+        baseUrl: `http://127.0.0.1:${address.port}`,
+        close: () => closeServer(server)
+    };
+}
+
+function closeServer(server) {
+    return new Promise((resolve, reject) => {
+        server.close((error) => {
+            if (error) reject(error);
+            else resolve();
+        });
+    });
+}
+
+function runMatrix(args, env) {
+    return new Promise((resolveResult) => {
+        const child = spawn(process.execPath, [matrixScript, ...args], {
+            cwd: repoRoot,
+            env: {
+                ...buildIsolatedEnvironment(),
+                ...env
+            },
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        child.once('error', () => {
+            resolveResult({ status: undefined, stdout, stderr });
+        });
+        child.once('close', (status) => {
+            resolveResult({ status: status ?? undefined, stdout, stderr });
+        });
+    });
+}
+
+function resolveGeneratedConfig(envFilePath) {
+    const script = [
+        "import { parseChannelPoolConfig } from './src/lib/channel-router.ts';",
+        "import { readImageGenerationBackend, readImageStreamingStrategy } from './src/lib/image-upstream-strategy.ts';",
+        'const formData = new FormData();',
+        'const config = parseChannelPoolConfig(process.env);',
+        'const credential = config.credentials[0];',
+        'console.log(JSON.stringify({',
+        '  channel: {',
+        '    id: credential.channelId,',
+        '    base_url: credential.baseUrl,',
+        '    request_modes: credential.requestModes,',
+        '    request_mode_priority: credential.requestModePriority',
+        '  },',
+        '  image_backend: readImageGenerationBackend(formData),',
+        '  streaming_strategy: readImageStreamingStrategy(formData)',
+        '}));'
+    ].join('\n');
+    return new Promise((resolveResult) => {
+        const child = spawn(process.execPath, ['--env-file', envFilePath, '--import', 'tsx', '--input-type=module', '--eval', script], {
+            cwd: repoRoot,
+            env: buildIsolatedEnvironment(),
+            stdio: ['ignore', 'pipe', 'pipe']
+        });
+        let stdout = '';
+        let stderr = '';
+        child.stdout.setEncoding('utf8');
+        child.stderr.setEncoding('utf8');
+        child.stdout.on('data', (chunk) => {
+            stdout += chunk;
+        });
+        child.stderr.on('data', (chunk) => {
+            stderr += chunk;
+        });
+        child.once('error', () => {
+            resolveResult({ status: undefined, stderr, value: undefined });
+        });
+        child.once('close', (status) => {
+            let value;
+            try {
+                value = JSON.parse(stdout);
+            } catch {}
+            resolveResult({ status: status ?? undefined, stderr, value });
+        });
+    });
+}
+
+function buildIsolatedEnvironment() {
+    const keepNames = ['HOME', 'PATH', 'SystemRoot', 'TEMP', 'TMP', 'TMPDIR', 'USERPROFILE'];
+    const environment = { GPT_IMAGE_AGENT_LOAD_ENV_FILE: '0' };
+    for (const name of keepNames) {
+        if (process.env[name] !== undefined) environment[name] = process.env[name];
+    }
+    return environment;
+}
+
+async function readJsonBody(request) {
+    let text = '';
+    request.setEncoding('utf8');
+    for await (const chunk of request) text += chunk;
+    return text ? JSON.parse(text) : {};
+}
+
+function sendJson(response, status, body) {
+    response.writeHead(status, { 'content-type': 'application/json' });
+    response.end(JSON.stringify(body));
+}
+
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}

scripts/dependency-installation.mjs

@@ -79,13 +79,13 @@ function collectDirectDependencies(rootPackage) {
 }
 
 function collectRootLockMismatches(directDependencies, packages) {
-    return directDependencies.filter((name) => !readPackageVersion(packages[`node_modules/${name}`]));
+    return directDependencies.filter((name) => !readPackageVersion(packages, `node_modules/${name}`));
 }
 
 function collectHiddenLockMismatches(directDependencies, rootPackages, hiddenPackages) {
     return directDependencies.flatMap((name) => {
-        const expected = readPackageVersion(rootPackages[`node_modules/${name}`]);
-        const actual = readPackageVersion(hiddenPackages[`node_modules/${name}`]);
+        const expected = readPackageVersion(rootPackages, `node_modules/${name}`);
+        const actual = readPackageVersion(hiddenPackages, `node_modules/${name}`);
         return actual === expected ? [] : [{ name, expected, actual }];
     });
 }
@@ -107,7 +107,7 @@ function inspectDirectPackageManifests(nodeModulesPath, directDependencies, root
             continue;
         }
         if (manifest.name !== name) nameMismatches.push({ expected: name, actual: manifest.name });
-        const expected = readPackageVersion(rootPackages[`node_modules/${name}`]);
+        const expected = readPackageVersion(rootPackages, `node_modules/${name}`);
         if (manifest.version !== expected) versionMismatches.push({ name, expected, actual: manifest.version });
     }
     return { missingPackages, invalidPackages, nameMismatches, versionMismatches };
@@ -125,8 +125,13 @@ function readPackageManifest(path) {
     }
 }
 
-function readPackageVersion(manifest) {
-    return typeof manifest?.version === 'string' && manifest.version.length > 0 ? manifest.version : undefined;
+function readPackageVersion(packages, packagePath, visited = new Set()) {
+    if (visited.has(packagePath)) return undefined;
+    visited.add(packagePath);
+    const manifest = packages[packagePath];
+    if (typeof manifest?.version === 'string' && manifest.version.length > 0) return manifest.version;
+    if (!manifest?.link || typeof manifest.resolved !== 'string') return undefined;
+    return readPackageVersion(packages, manifest.resolved, visited);
 }
 
 function buildFailure(reason, details = {}) {

scripts/dependency-installation.test.mjs

@@ -19,10 +19,29 @@ const ROOT_LOCKFILE = {
     }
 };
 
-async function createFixture({ hiddenLockfile, manifests = {} } = {}) {
+const LOCAL_LINK_ROOT_LOCKFILE = {
+    name: 'fixture',
+    lockfileVersion: 3,
+    packages: {
+        '': {
+            name: 'fixture',
+            dependencies: { demo: 'file:vendor/demo' }
+        },
+        'node_modules/demo': {
+            resolved: 'vendor/demo',
+            link: true
+        },
+        'vendor/demo': {
+            name: 'demo',
+            version: '1.0.0'
+        }
+    }
+};
+
+async function createFixture({ rootLockfile = ROOT_LOCKFILE, hiddenLockfile, manifests = {} } = {}) {
     const root = await mkdtemp(join(tmpdir(), 'gipc-dependency-installation-'));
     await mkdir(join(root, 'node_modules'), { recursive: true });
-    await writeFile(join(root, 'package-lock.json'), JSON.stringify(ROOT_LOCKFILE));
+    await writeFile(join(root, 'package-lock.json'), JSON.stringify(rootLockfile));
     if (hiddenLockfile !== undefined) {
         await writeFile(join(root, 'node_modules', '.package-lock.json'), JSON.stringify(hiddenLockfile));
     }
@@ -105,4 +124,45 @@ describe('dependency installation inspection', () => {
             await rm(root, { force: true, recursive: true });
         }
     });
+
+    it('accepts a local file dependency whose link target matches both lockfiles', async () => {
+        const root = await createFixture({
+            rootLockfile: LOCAL_LINK_ROOT_LOCKFILE,
+            hiddenLockfile: buildHiddenLockfile(LOCAL_LINK_ROOT_LOCKFILE.packages),
+            manifests: {
+                demo: { name: 'demo', version: '1.0.0' }
+            }
+        });
+        try {
+            const state = inspectDependencyInstallation(root);
+
+            assert.equal(state.ok, true);
+            assert.deepEqual(state.directDependencies, ['demo']);
+        } finally {
+            await rm(root, { force: true, recursive: true });
+        }
+    });
+
+    it('detects a local file dependency version mismatch in the hidden lockfile', async () => {
+        const hiddenLockfile = buildHiddenLockfile({
+            ...LOCAL_LINK_ROOT_LOCKFILE.packages,
+            'vendor/demo': { name: 'demo', version: '1.1.0' }
+        });
+        const root = await createFixture({
+            rootLockfile: LOCAL_LINK_ROOT_LOCKFILE,
+            hiddenLockfile,
+            manifests: {
+                demo: { name: 'demo', version: '1.0.0' }
+            }
+        });
+        try {
+            const state = inspectDependencyInstallation(root);
+
+            assert.equal(state.ok, false);
+            assert.equal(state.reason, 'hidden_lockfile_package_mismatch');
+            assert.deepEqual(state.hiddenLockMismatches, [{ name: 'demo', expected: '1.0.0', actual: '1.1.0' }]);
+        } finally {
+            await rm(root, { force: true, recursive: true });
+        }
+    });
 });

scripts/docker-build-context.test.mjs

@@ -16,6 +16,7 @@ describe('Docker build context', () => {
         assert.match(dockerignore, /^\.env\.\*$/m);
         assert.match(dockerignore, /^!\.env\.real-smoke\.example$/m);
         assert.match(dockerfile, /^COPY \. \.$/m);
+        assert.match(dockerfile, /^COPY vendor\/brace-expansion-compat \.\/vendor\/brace-expansion-compat$/m);
         assert.match(gitignore, /^!\.env\.real-smoke\.example$/m);
         assert.match(realSmokeTemplate, /^IMAGE_REAL_SMOKE_TIMEOUT_MS=240000$/m);
     });

scripts/env-summary.mjs

@@ -6,6 +6,7 @@ import { isMainModule, printJson, runCommand } from './command-center-utils.mjs'
 
 const DEFAULT_ENV_FILES = ['.env.local', '.env.real-smoke.local', '.env.agent.local'];
 const SECRET_NAME_PATTERN = /(API_?KEY|API_?KEYS|TOKEN|PASSWORD|SECRET|CREDENTIAL|PRIVATE)/i;
+const PRIVATE_ENDPOINT_NAME_PATTERN = /PROXY/i;
 const URL_NAME_PATTERN = /(BASE_URL|URL|ENDPOINT|HOST)$/i;
 const DOCKER_INSPECT_TIMEOUT_MS = 10_000;
 
@@ -53,7 +54,7 @@ export function summarizeEnvEntries(entries) {
 
 function summarizeEnvEntry(name, value) {
     const set = value.length > 0;
-    const sensitive = SECRET_NAME_PATTERN.test(name);
+    const sensitive = SECRET_NAME_PATTERN.test(name) || PRIVATE_ENDPOINT_NAME_PATTERN.test(name);
     const summary = { name, set, sensitive, value_kind: classifyValue(value) };
     if (sensitive && set) {
         summary.item_count = value.split(',').map((item) => item.trim()).filter(Boolean).length;

scripts/env-summary.test.mjs

@@ -17,6 +17,7 @@ describe('env-summary', () => {
                 'OPENAI_API_KEY=sk-real-looking-secret-value',
                 'OPENAI_CHANNEL_1_API_KEYS=key-one,key-two',
                 'OPENAI_API_BASE_URL=https://api.example.com/v1',
+                'OPENAI_UPSTREAM_PROXY_URL=http://proxy.internal.example:8080',
                 'REDIS_HOST=localhost:6379',
                 'PUBLIC_NAME=value # deployment note',
                 'ENABLE_STREAMING_BATCH=true',
@@ -30,6 +31,8 @@ describe('env-summary', () => {
         assert.equal(serialized.includes('sk-real-looking-secret-value'), false);
         assert.equal(serialized.includes('key-one'), false);
         assert.equal(serialized.includes('key-two'), false);
+        assert.equal(serialized.includes('proxy.internal.example'), false);
+        assert.equal(serialized.includes('8080'), false);
         assert.equal(serialized.includes('deployment note'), false);
         assert.deepEqual(summary.find((item) => item.name === 'OPENAI_API_KEY'), {
             name: 'OPENAI_API_KEY',
@@ -39,6 +42,13 @@ describe('env-summary', () => {
             item_count: 1
         });
         assert.equal(summary.find((item) => item.name === 'OPENAI_CHANNEL_1_API_KEYS')?.item_count, 2);
+        assert.deepEqual(summary.find((item) => item.name === 'OPENAI_UPSTREAM_PROXY_URL'), {
+            name: 'OPENAI_UPSTREAM_PROXY_URL',
+            set: true,
+            sensitive: true,
+            value_kind: 'url',
+            item_count: 1
+        });
         assert.deepEqual(summary.find((item) => item.name === 'OPENAI_API_BASE_URL')?.url, {
             valid: true,
             protocol: 'https',

scripts/smoke-image-upstream-compat.mjs

@@ -15,6 +15,7 @@ function configureRouteEnv() {
         'APP_PASSWORD',
         'OPENAI_API_KEY',
         'OPENAI_API_BASE_URL',
+        'OPENAI_UPSTREAM_PROXY_URL',
         'OPENAI_CHANNEL_1_API_KEYS',
         'OPENAI_CHANNEL_1_BASE_URL',
         'IMAGE_GENERATION_BACKEND',

scripts/smoke-image-upstream-local-final-gate.mjs

@@ -187,6 +187,7 @@ function isSmokeEnvKey(key) {
         key.startsWith('OPENAI_CHANNEL_') ||
         key === 'OPENAI_API_BASE_URL' ||
         key === 'OPENAI_API_KEY' ||
+        key === 'OPENAI_UPSTREAM_PROXY_URL' ||
         key === 'OPENAI_RESPONSES_API_MODEL' ||
         key === 'OPENAI_ROUTING_STRATEGY' ||
         key === 'OPENAI_CHANNELS_JSON' ||

scripts/smoke-image-upstream-real.test.mjs

@@ -1025,6 +1025,7 @@ function isSmokeEnvKey(key) {
         key.startsWith('OPENAI_CHANNEL_') ||
         key === 'OPENAI_API_BASE_URL' ||
         key === 'OPENAI_API_KEY' ||
+        key === 'OPENAI_UPSTREAM_PROXY_URL' ||
         key === 'OPENAI_RESPONSES_API_MODEL' ||
         key === 'OPENAI_ROUTING_STRATEGY' ||
         key === 'OPENAI_CHANNELS_JSON' ||

skills/gpt-image-playground-agent/SKILL.md

@@ -1,6 +1,6 @@
 ---
 name: gpt-image-playground-agent
-description: 当用户需要通过已部署的 GPT Image Playground 生成、编辑、批量生成、转换图片格式、查询结果反馈、渠道健康或诊断图片接口时使用；必须优先运行本 Skill 内置 scripts/generate-image.mjs、edit-image.mjs、batch-images.mjs、convert-image-format.mjs、diagnose-request.mjs、diagnose-channel-health.mjs 或 probe-upstream-image.mjs，而不是临时编写 API 调用脚本。
+description: 当用户需要通过已部署的 GPT Image Playground 生成、编辑、批量生成、转换图片格式、查询结果反馈、渠道健康、诊断图片接口，或对新图片上游运行完整能力矩阵并生成私有渠道配置时使用；必须优先运行本 Skill 内置 scripts/generate-image.mjs、edit-image.mjs、batch-images.mjs、convert-image-format.mjs、diagnose-request.mjs、diagnose-channel-health.mjs、probe-upstream-image.mjs 或 channel-capability-matrix.mjs，而不是临时编写 API 调用脚本。
 ---
 
 # GPT Image Playground Agent
@@ -18,6 +18,7 @@ Agent API 是给自动化客户端使用的机器接口，不是自治 Agent 平
 - 查询页面请求的结果反馈或日志诊断摘要：优先运行 `scripts/diagnose-request.mjs`。
 - 查询当前实例内存中的渠道、凭证和请求方式健康状态：优先运行 `scripts/diagnose-channel-health.mjs`。它只读调用 Agent API，不触发上游探测或图片生成，也不能证明真实上游可用。
 - 诊断上游图片接口：优先运行 `scripts/probe-upstream-image.mjs`。接入新上游渠道时，先确认 `/models` 和 `/images/generations` 能通，再用 `npm run smoke:image-upstream-real -- --allow-billable` 逐个验证 `original-images-json`、`sub2api-images-sse`、`sub2api-responses-json`、`gpt2image-responses-sse`。脚本也接受 request mode 别名 `images-json`、`images-sse`、`responses-json`、`responses-sse`，方便按通道能力筛选 case。只有内联 `b64_json`、Responses `result` 或与 API Base URL 同源的 artifact URL 才算可被本服务消费；远程 URL-only 结果不能写入 `OPENAI_CHANNEL_N_REQUEST_MODES`。如果某一路径先返回 `object=image.task,status=pending`，说明该请求方式不是直接完成结果；应先确认同一业务键能否在同一渠道下重试拿到最终图片，再把可用的 `request_modes` 写入 `OPENAI_CHANNEL_N_REQUEST_MODES`。如果 `/v1/responses` 返回 `403 Image generation is not enabled for this group`，或 HTTP 200 但只返回文本 output、没有 `image_generation_call.result`/`url`，就把对应 `responses-*` mode 从 `OPENAI_CHANNEL_N_REQUEST_MODES` 移除。服务端未配置 `OPENAI_CHANNEL_N_REQUEST_MODE_PRIORITY` 时按费用更少优先选择：`images-non-stream`、`images-sse`、`responses-non-stream`、`responses-sse`；只有真实 smoke 证明需要改变顺序时，管理员才写入 `OPENAI_CHANNEL_N_REQUEST_MODE_PRIORITY` 或全局 `OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY`。
+- 对新上游完成固定四模式验证并准备可直接使用的私有配置：运行 `scripts/channel-capability-matrix.mjs`。只有用户明确允许计费时才传 `--allow-billable`；需要输出配置时再显式传 `--write-env-file <private-path>`。它固定串行验证 Images/Responses 的非流式和 SSE 模式，仅在 `/models` 通过、矩阵完整、至少一个方式返回可消费最终图且凭证有效时写入。生成文件只保留实际通过的 `OPENAI_CHANNEL_N_REQUEST_MODES`，显式设置匹配实测能力的 `IMAGE_GENERATION_BACKEND` 和 `IMAGE_STREAMING_STRATEGY=auto`；若没有任何 Images API 模式通过，则默认使用 `responses-image-generation`。Responses 模式通过时会同时启用 Responses 后端并写入实测顶层模型；远程明文 HTTP 目标会写入精确的 `OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS`，使生成配置符合服务端安全门禁。输出文件是权限 `0600` 的独立私有 env 配置，默认拒绝覆盖和符号链接；脚本不合并或自动改写现有 `.env.local`，不会重启服务或部署。
 - 不要临时编写 Node/Python/shell 脚本、curl 命令或手写 fetch/FormData 来重复实现这些脚本已经覆盖的 API 调用。
 - 只有在内置脚本缺少用户明确需要的能力时，才修改或扩展 `scripts/` 内的预置脚本，并同步补测试；不要在仓库外留下 ad hoc 调用脚本。
 - 先用 dry-run、`--check-remote` 或 `--contract-check` 检查请求、路由、鉴权和服务声明的默认编排入口；只有用户明确允许真实计费时才加 `--allow-billable`。

skills/gpt-image-playground-agent/agents/openai.yaml

@@ -1,4 +1,4 @@
 interface:
   display_name: "GPT Image Agent API"
-  short_description: "使用内置脚本调用图片 Agent API，并确认目标服务地址"
-  default_prompt: "使用 $gpt-image-playground-agent 先选择并运行内置脚本；运行前先定位服务地址，用户提供 URL 时显式传 --base-url，自动发现本地或环境变量地址时先确认，不要临时编写 API 调用脚本。"
+  short_description: "用内置脚本生成图片、诊断服务并验证上游渠道能力矩阵"
+  default_prompt: "使用 $gpt-image-playground-agent 先选择并运行内置脚本；新上游先运行能力矩阵，只有真实验证通过后才生成私有渠道配置，不要临时编写 API 调用脚本。"

skills/gpt-image-playground-agent/references/api.md

@@ -29,6 +29,7 @@ Agent API 是给自动化客户端使用的机器接口，不是自治 Agent 平
 - `scripts/diagnose-request.mjs`：按页面 `clientRequestId` 只读查询结果反馈和脱敏日志诊断摘要，也可按 Agent `request_id` 或 `idempotency_key` 查询 Agent state 请求诊断，支持 `--base-url` 固定目标服务。
 - `scripts/diagnose-channel-health.mjs`：通过 capabilities 声明的 Agent 端点读取当前服务进程的渠道健康快照，支持 `--base-url` 和 `--output`。
 - `scripts/probe-upstream-image.mjs`：上游图片接口连通性探针。
+- `scripts/channel-capability-matrix.mjs`：固定串行验证四种上游图片请求方式，并在真实验证通过后生成私有渠道 env 配置。
 
 生成、编辑和批量脚本默认只做 dry-run，不触发真实生图或编辑。dry-run 输出的 `verification_scope.mode=local_planning_only` 表示只完成本地请求构造、参数归一化和静态路由规划；它不会读取远端 capabilities，不会验证远端鉴权、渠道容量或 manifest 写入。generate 可添加 `--check-remote` 做只读远端检查，输出 `verification_scope.mode=remote_contract_and_local_planning`，仅访问 `/api/agent/capabilities` 和 `/api/runtime-capabilities`，不会发送真实生图请求。必须显式添加 `--allow-billable` 才会调用真实端点。generate 默认提交到 `/api/agent/image-requests` 服务端编排入口；`--agent`、`--job`、`--page-sse` 才会显式改用 `/api/agent/images/generate`、`/api/agent/jobs/images/generate` 或页面端 `/api/images` SSE。
 上游探针默认只检查 DNS、TLS 和 `/models`，必须显式添加 `--allow-billable` 才会调用上游 `/images/generations`。
@@ -192,6 +193,16 @@ node "<skill-root>/scripts/batch-images.mjs" --allow-billable --input tasks.json
 
 上游探针读取 `GPT_IMAGE_UPSTREAM_BASE_URL` 或 `OPENAI_API_BASE_URL` 作为上游地址，读取 `GPT_IMAGE_UPSTREAM_API_KEY` 或 `OPENAI_API_KEY` 作为上游鉴权。base URL 必须是无凭据、无查询参数和无片段的 `http`/`https` 绝对 URL。输出不会包含 key，也不会输出完整 base64。
 
+## 渠道能力矩阵和私有配置
+
+```text
+node "<skill-root>/scripts/channel-capability-matrix.mjs" --base-url https://upstream.example.com/v1 --responses-model gpt-5.4 --allow-billable --write-env-file /private/path/channel.env
+```
+
+该脚本固定串行调用 `images-non-stream`、`images-sse`、`responses-non-stream`、`responses-sse`，不会把未测、失败、pending/poll 或远程 URL-only 结果写入渠道白名单。`--write-env-file` 必须与 `--allow-billable` 一起使用；写入还要求 `/models` 成功、四种模式都有报告、至少一个模式返回本服务可消费的最终图片、API Key 有效，且 Responses 模式有可用顶层模型。任何条件不满足时只输出脱敏矩阵报告，不创建目标文件。
+
+写入的独立私有 env 配置包含 `OPENAI_CHANNEL_N_*`、实测通过的模式和优先级、`IMAGE_GENERATION_BACKEND`、`IMAGE_STREAMING_STRATEGY=auto`，以及需要时的 `ENABLE_RESPONSES_IMAGE_BACKEND` 和 `OPENAI_RESPONSES_API_MODEL`。只要至少一个 Images API 模式通过，默认后端为 `images-api`；只有 Responses 模式通过时，默认后端为 `responses-image-generation`，因此普通服务请求也会选择实际可用的协议。远程明文 HTTP 上游会额外写入精确的 `OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS`，以满足服务端对非 loopback HTTP 的安全门禁。目标文件使用原子写入和权限 `0600`，默认拒绝覆盖或符号链接；标准输出只提供脱敏 `configuration.env_preview`。脚本不会合并或自动写入 `.env.local`，不会重启服务或部署。
+
 ## 能力查询
 
 ```http
@@ -207,6 +218,7 @@ GET /api/agent/capabilities
 - `image_transport.upstream_timeout_ms`：当前服务端图片上游请求超时，脚本未显式传 `--timeout-ms` 时会用它延长默认超时。
 - `image_transport.stream_data_interval_timeout_ms`：已建立图片流的单次数据空闲超时；`0` 表示服务端禁用该空闲计时器。
 - `image_transport.upstream_max_retries`：OpenAI SDK 图片请求自动重试次数；默认 `0`，避免长耗时图片请求被 SDK 自动重试后重复计费。
+- `image_transport.upstream_proxy`：全局服务端上游代理摘要，只包含 `configured` 和可选的 `protocol`（`http` 或 `https`）；不会返回代理主机、端口、认证信息或完整 URL。代理由部署管理员通过 `OPENAI_UPSTREAM_PROXY_URL` 配置，只影响服务端到图片上游的出站连接。
 - `model_limits.gpt-image-2.max_edge`：最大单边像素，当前为 `3840`。
 - `model_limits.gpt-image-2.max_pixels`：最大总像素，当前为 `8294400`。
 - `model_limits.gpt-image-2.edge_multiple`：宽高必须是该值的倍数，当前为 `16`。
@@ -233,6 +245,7 @@ GET /api/agent/capabilities
 - `supported.request_modes`：服务端支持的上游请求方式枚举，当前为 `images-non-stream`、`images-sse`、`responses-non-stream`、`responses-sse`。该字段描述服务端能力全集，不代表每个管理员渠道都已真实 smoke 通过。
 - `upstream_request_headers.default`：默认上游请求头摘要，包含 `user_agent_effective`、`has_extra_headers`、`allowed_header_names` 和 `configured_header_names`。
 - `upstream_request_headers.channels`：每个服务端渠道的脱敏请求头摘要，包含该渠道有效 `request_modes` 和按白名单过滤后的 `request_mode_priority`。该字段不包含 API key、Authorization 值、Matsca app secret 值或任意 header value。
+- `upstream_request_headers.channels[].upstream_proxy`：该渠道的有效上游代理摘要。`OPENAI_CHANNEL_N_PROXY_URL` 优先于 `OPENAI_UPSTREAM_PROXY_URL`；摘要只返回 `configured` 和 `protocol`，不返回代理地址或端口。
 - `request_mode_controls`：管理员 request mode 白名单和优先级控制面，声明 `OPENAI_UPSTREAM_REQUEST_MODES`、`OPENAI_CHANNEL_N_REQUEST_MODES`、`OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY`、`OPENAI_CHANNEL_N_REQUEST_MODE_PRIORITY`、默认低费用优先顺序、真实 smoke gate 和 `agent_client_policy=diagnostics_only`；Agent 客户端只能用于解释执行结果，不应据此自行选择上游请求方式。接入新渠道时，先用 `scripts/probe-upstream-image.mjs` 验证 `/models` 和 `/images/generations`，再用 `npm run smoke:image-upstream-real -- --allow-billable` 跑 `original-images-json`、`sub2api-images-sse`、`sub2api-responses-json`、`gpt2image-responses-sse` 之类的真实 smoke；也可用 `--case images-json`、`--case images-sse`、`--case responses-json`、`--case responses-sse` 按 request mode 筛选。脚本输出的 `request_modes.passed` 和顶层 `suggested_channel_config` 是写入 `OPENAI_CHANNEL_N_REQUEST_MODES` 的候选值；未通过、未实测、只返回远程 URL-only 或只返回 pending/poll_url 的 mode 不应写入。只有内联 `b64_json`、Responses `result` 或与 API Base URL 同源的 artifact URL 才算可被本服务消费。如果 `/v1/responses` 返回 `403 Image generation is not enabled for this group`，或 HTTP 200 但只返回文本 output、没有 `image_generation_call.result`/`url`，就把对应 `responses-*` mode 从白名单里删掉，只保留通过的模式。需要覆盖默认排序时，再把通过的 mode 按期望顺序写入 `OPENAI_CHANNEL_N_REQUEST_MODE_PRIORITY`。
 - `providerManifests[].manifest.executionSupport`：`implemented` 表示当前执行器可按现有 Images/Responses 路径执行；`declared_only` 表示 manifest 声明了 async-poll，但当前执行器不会自动轮询 provider `poll` 配置。pending/poll_url 只能作为诊断线索，不是可写入 request mode 白名单的通过证明。
 - `routing_rules.high_resolution_edit`：`edit` 且最大边大于 `2048` 时默认优先使用页面端 `/api/images` SSE，页面流式有问题时显式回退。
@@ -273,6 +286,8 @@ GET /api/agent/capabilities
 
 上游请求头策略由服务端统一执行。默认 `User-Agent` 是 `gpt-image-playground/<package-version>`；可用 `OPENAI_UPSTREAM_USER_AGENT` 或 `UPSTREAM_USER_AGENT` 覆盖全局 UA，也可用 `OPENAI_CHANNEL_N_USER_AGENT` 和 `OPENAI_CHANNEL_N_UPSTREAM_HEADERS_JSON` 覆盖单渠道安全 header。`Authorization`、`Accept`、`Content-Type`、`Content-Length` 和 `Host` 等协议头不可由 extra headers 覆盖；固定业务头和鉴权头始终由调用路径设置。
 
+上游代理同样由服务端统一执行：`OPENAI_UPSTREAM_PROXY_URL` 为全局默认值，`OPENAI_CHANNEL_N_PROXY_URL` 可覆盖单个渠道。它们只接受无认证、无路径、无查询参数和无片段的 `http://` 或 `https://` 根代理地址，不支持 SOCKS；配置变更需重启或重新部署服务。代理适用于服务端上游 API、SSE、同源结果图下载、渠道恢复探测和 new-api 用量日志，不影响 Agent 客户端到 Playground 的连接。
+
 ## Job Polling
 
 ```http

skills/gpt-image-playground-agent/scripts/channel-capability-matrix.mjs

@@ -0,0 +1,367 @@
+#!/usr/bin/env node
+import { spawn } from 'node:child_process';
+import { closeSync, chmodSync, existsSync, fsyncSync, linkSync, lstatSync, openSync, renameSync, statSync, unlinkSync, writeFileSync } from 'node:fs';
+import { randomBytes } from 'node:crypto';
+import { basename, dirname, join, resolve } from 'node:path';
+import { fileURLToPath } from 'node:url';
+import {
+  buildCapabilityMatrix,
+  buildChannelEnvConfig,
+  buildRedactedChannelEnvPreview,
+  createDefaultChannelId,
+  redactKnownSecrets,
+  resolveUpstreamApiKey,
+  validateChannelApiKey,
+  validateChannelId
+} from './lib/channel-capability-matrix.mjs';
+import {
+  errorMessage,
+  loadPrivateAgentEnvFile,
+  normalizeBaseUrl,
+  readConfiguredPositiveInteger,
+  readOptionValue
+} from './lib/script-utils.mjs';
+
+const SCRIPT_DIRECTORY = dirname(fileURLToPath(import.meta.url));
+const PROBE_SCRIPT_PATH = join(SCRIPT_DIRECTORY, 'probe-upstream-image.mjs');
+const DEFAULT_UPSTREAM_BASE_URL = 'https://api.openai.com/v1';
+
+loadPrivateAgentEnvFile();
+
+let options;
+try {
+  options = parseArgs(process.argv.slice(2));
+  if (options.help) {
+    printUsage();
+    process.exit(0);
+  }
+  validateOptions(options);
+} catch (error) {
+  console.error(errorMessage(error));
+  printUsage();
+  process.exit(2);
+}
+
+try {
+  const baseUrl = normalizeBaseUrl(
+    options.baseUrl || process.env.GPT_IMAGE_UPSTREAM_BASE_URL || process.env.OPENAI_API_BASE_URL || DEFAULT_UPSTREAM_BASE_URL
+  );
+  const upstream = new URL(baseUrl);
+  const apiKey = resolveUpstreamApiKey();
+  const apiKeyValidation = validateChannelApiKey(apiKey.value);
+  const channelId = options.channelId || createDefaultChannelId(upstream.hostname, options.channelIndex);
+  const channelIdValidation = validateChannelId(channelId);
+  if (!channelIdValidation.ok) throw new Error('--channel-id 只能包含字母、数字、点、下划线和连字符，且长度不超过 64。');
+  if (options.writeEnvFile && !apiKeyValidation.ok) {
+    throw new Error('生成私有配置需要设置有效的 GPT_IMAGE_UPSTREAM_API_KEY 或 OPENAI_API_KEY。');
+  }
+  if (options.writeEnvFile) {
+    const target = inspectPrivateEnvTarget(options.writeEnvFile, options.overwrite);
+    if (!target.ok) throw new Error(target.message);
+  }
+
+  await runCapabilityMatrix({ baseUrl, upstream, apiKey, apiKeyValidation, channelId });
+} catch (error) {
+  console.error(errorMessage(error));
+  process.exit(2);
+}
+
+function parseArgs(argv) {
+  const parsed = {
+    baseUrl: undefined,
+    model: 'gpt-image-2',
+    responsesModel: undefined,
+    prompt: 'channel capability matrix probe',
+    size: '1024x1024',
+    quality: 'low',
+    format: 'webp',
+    outputCompression: undefined,
+    timeoutMs: undefined,
+    channelIndex: 1,
+    channelId: undefined,
+    writeEnvFile: undefined,
+    overwrite: false,
+    allowBillable: false,
+    help: false
+  };
+
+  for (let index = 0; index < argv.length; index += 1) {
+    const arg = argv[index];
+    if (arg === '--base-url') parsed.baseUrl = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--model') parsed.model = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--responses-model') parsed.responsesModel = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--prompt') parsed.prompt = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--size') parsed.size = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--quality') parsed.quality = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--format' || arg === '--output-format') parsed.format = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--output-compression') parsed.outputCompression = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--timeout-ms') parsed.timeoutMs = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--channel-index') parsed.channelIndex = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--channel-id') parsed.channelId = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--write-env-file') parsed.writeEnvFile = readOptionValue(argv, (index += 1), arg);
+    else if (arg === '--overwrite') parsed.overwrite = true;
+    else if (arg === '--allow-billable') parsed.allowBillable = true;
+    else if (arg === '--help' || arg === '-h') parsed.help = true;
+    else throw new Error('包含未知参数。');
+  }
+
+  return parsed;
+}
+
+function validateOptions(parsed) {
+  if (!/^[1-9]\d*$/.test(String(parsed.channelIndex))) {
+    throw new Error('--channel-index 必须是正整数。');
+  }
+  parsed.channelIndex = Number(parsed.channelIndex);
+  if (!Number.isSafeInteger(parsed.channelIndex)) throw new Error('--channel-index 必须是正整数。');
+  if (parsed.overwrite && !parsed.writeEnvFile) throw new Error('--overwrite 必须和 --write-env-file 一起使用。');
+  if (parsed.writeEnvFile && !parsed.allowBillable) {
+    throw new Error('--write-env-file 需要同时使用 --allow-billable。');
+  }
+  if (parsed.timeoutMs !== undefined) readConfiguredPositiveInteger(parsed.timeoutMs, '--timeout-ms', 30000);
+}
+
+async function runCapabilityMatrix(input) {
+  const probeResult = await runProbe(options, input.baseUrl);
+  const probeReport = parseProbeReport(probeResult.stdout);
+  const redactText = (value) => redactKnownSecrets(value, [input.apiKey.value]);
+  const matrix = buildCapabilityMatrix({
+    probeReport,
+    allowBillable: options.allowBillable,
+    apiKeyValid: input.apiKeyValidation.ok,
+    apiKeyError: input.apiKeyValidation.reason,
+    redactText
+  });
+  const configuration = {
+    ...matrix.configuration,
+    channel_index: options.channelIndex,
+    channel_id: input.channelId,
+    ...(matrix.configuration.ready
+      ? {
+          env_preview: buildRedactedChannelEnvPreview({
+            channelIndex: options.channelIndex,
+            channelId: input.channelId,
+            baseUrl: input.baseUrl,
+            requestModes: matrix.configuration.request_modes,
+            requestModePriority: matrix.configuration.request_mode_priority,
+            responsesModel: matrix.configuration.responses_model
+          })
+        }
+      : {})
+  };
+
+  let write = { requested: Boolean(options.writeEnvFile), attempted: false, written: false, reason: 'not_requested' };
+  if (options.writeEnvFile) {
+    if (!configuration.ready) {
+      write = { requested: true, attempted: false, written: false, reason: 'configuration_not_ready' };
+    } else {
+      const content = buildChannelEnvConfig({
+        channelIndex: options.channelIndex,
+        channelId: input.channelId,
+        baseUrl: input.baseUrl,
+        apiKey: input.apiKey.value,
+        requestModes: configuration.request_modes,
+        requestModePriority: configuration.request_mode_priority,
+        responsesModel: configuration.responses_model
+      });
+      write = { requested: true, attempted: true, ...writePrivateEnvFile(options.writeEnvFile, content, options.overwrite) };
+    }
+  }
+
+  const report = {
+    ok: configuration.ready && (!options.writeEnvFile || write.written),
+    billable: options.allowBillable,
+    transport: 'channel_capability_matrix',
+    upstream: {
+      base_url: input.baseUrl,
+      host: input.upstream.host,
+      api_key_configured: Boolean(input.apiKey.value)
+    },
+    probe: {
+      completed: probeReport !== undefined,
+      exit_code: probeResult.exitCode,
+      stderr_present: probeResult.stderr.trim().length > 0
+    },
+    preflight: matrix.preflight,
+    matrix: {
+      requested: matrix.requested,
+      coverage_complete: matrix.coverage_complete,
+      fully_supported: matrix.fully_supported,
+      passed: matrix.passed,
+      failed: matrix.failed,
+      skipped: matrix.skipped,
+      modes: matrix.modes
+    },
+    configuration,
+    write,
+    summary: {
+      ok: configuration.ready && (!options.writeEnvFile || write.written),
+      billable: options.allowBillable,
+      request_modes: configuration.request_modes,
+      blocking_reasons: configuration.blocking_reasons,
+      next_action: readNextAction({ configuration, write, writeRequested: Boolean(options.writeEnvFile) })
+    }
+  };
+
+  console.log(JSON.stringify(redactKnownSecrets(report, [input.apiKey.value]), null, 2));
+  process.exitCode = report.ok ? 0 : 1;
+}
+
+async function runProbe(parsed, normalizedBaseUrl) {
+  const args = [
+    PROBE_SCRIPT_PATH,
+    '--base-url',
+    normalizedBaseUrl,
+    '--model',
+    parsed.model,
+    '--prompt',
+    parsed.prompt,
+    '--size',
+    parsed.size,
+    '--quality',
+    parsed.quality,
+    '--format',
+    parsed.format,
+    '--request-mode',
+    'all'
+  ];
+  if (parsed.responsesModel) args.push('--responses-model', parsed.responsesModel);
+  if (parsed.outputCompression !== undefined) args.push('--output-compression', parsed.outputCompression);
+  if (parsed.timeoutMs !== undefined) args.push('--timeout-ms', parsed.timeoutMs);
+  if (parsed.allowBillable) args.push('--allow-billable');
+
+  return await new Promise((resolveResult) => {
+    const child = spawn(process.execPath, args, {
+      env: process.env,
+      stdio: ['ignore', 'pipe', 'pipe']
+    });
+    let stdout = '';
+    let stderr = '';
+    child.stdout.setEncoding('utf8');
+    child.stderr.setEncoding('utf8');
+    child.stdout.on('data', (chunk) => {
+      stdout += chunk;
+    });
+    child.stderr.on('data', (chunk) => {
+      stderr += chunk;
+    });
+    child.once('error', () => {
+      resolveResult({ exitCode: undefined, stdout, stderr });
+    });
+    child.once('close', (exitCode) => {
+      resolveResult({ exitCode: exitCode ?? undefined, stdout, stderr });
+    });
+  });
+}
+
+function parseProbeReport(stdout) {
+  try {
+    const parsed = JSON.parse(stdout);
+    return parsed && typeof parsed === 'object' && !Array.isArray(parsed) ? parsed : undefined;
+  } catch {
+    return undefined;
+  }
+}
+
+function inspectPrivateEnvTarget(targetPath, overwrite) {
+  const absoluteTarget = resolve(targetPath);
+  const targetDirectory = dirname(absoluteTarget);
+  const targetName = basename(absoluteTarget);
+  if (!targetName || targetName === '.') {
+    return { ok: false, message: '--write-env-file 必须指定常规文件路径。' };
+  }
+
+  try {
+    const directoryStat = statSync(targetDirectory);
+    if (!directoryStat.isDirectory()) {
+      return { ok: false, message: '--write-env-file 的父目录不可用。' };
+    }
+  } catch {
+    return { ok: false, message: '--write-env-file 的父目录不可用。' };
+  }
+
+  if (!existsSync(absoluteTarget)) return { ok: true };
+  try {
+    const targetStat = lstatSync(absoluteTarget);
+    if (targetStat.isSymbolicLink()) {
+      return { ok: false, message: '--write-env-file 不接受符号链接目标。' };
+    }
+    if (!targetStat.isFile()) {
+      return { ok: false, message: '--write-env-file 只能覆盖常规文件。' };
+    }
+    if (!overwrite) {
+      return { ok: false, message: '目标私有配置文件已存在；确认替换后显式添加 --overwrite。' };
+    }
+    return { ok: true };
+  } catch {
+    return { ok: false, message: '--write-env-file 目标不可用。' };
+  }
+}
+
+function writePrivateEnvFile(targetPath, content, overwrite) {
+  const absoluteTarget = resolve(targetPath);
+  const targetDirectory = dirname(absoluteTarget);
+  const targetName = basename(absoluteTarget);
+  let temporaryPath;
+
+  try {
+    if (!targetName || targetName === '.') return { written: false, reason: 'invalid_target' };
+    const directoryStat = statSync(targetDirectory);
+    if (!directoryStat.isDirectory()) return { written: false, reason: 'invalid_target_directory' };
+
+    if (existsSync(absoluteTarget)) {
+      const targetStat = lstatSync(absoluteTarget);
+      if (targetStat.isSymbolicLink()) return { written: false, reason: 'target_is_symlink' };
+      if (!targetStat.isFile()) return { written: false, reason: 'target_not_regular_file' };
+      if (!overwrite) return { written: false, reason: 'target_exists' };
+    }
+
+    temporaryPath = join(targetDirectory, `.${targetName}.channel-capability-${process.pid}-${randomBytes(8).toString('hex')}.tmp`);
+    writeFileSync(temporaryPath, content, { encoding: 'utf8', flag: 'wx', mode: 0o600 });
+    chmodSync(temporaryPath, 0o600);
+    const descriptor = openSync(temporaryPath, 'r');
+    try {
+      fsyncSync(descriptor);
+    } finally {
+      closeSync(descriptor);
+    }
+
+    if (overwrite) {
+      renameSync(temporaryPath, absoluteTarget);
+    } else {
+      try {
+        linkSync(temporaryPath, absoluteTarget);
+      } catch (error) {
+        if (error && typeof error === 'object' && error.code === 'EEXIST') {
+          return { written: false, reason: 'target_exists' };
+        }
+        throw error;
+      }
+      unlinkSync(temporaryPath);
+    }
+    chmodSync(absoluteTarget, 0o600);
+    temporaryPath = undefined;
+    return { written: true, reason: 'written' };
+  } catch {
+    return { written: false, reason: 'write_failed' };
+  } finally {
+    if (temporaryPath && existsSync(temporaryPath)) unlinkSync(temporaryPath);
+  }
+}
+
+function readNextAction(input) {
+  if (!input.configuration.ready) return 'inspect_capability_matrix';
+  if (input.writeRequested && !input.write.written) return 'resolve_private_config_write';
+  if (input.writeRequested) return 'apply_private_config_and_restart_explicitly';
+  return 'write_private_config_explicitly';
+}
+
+function printUsage() {
+  console.error('用法：channel-capability-matrix.mjs [options]');
+  console.error('固定串行验证 Images/Responses 的 JSON 与 SSE 四种请求方式。');
+  console.error('只有 --allow-billable 且至少一个方式返回可消费图片时，才允许写入私有渠道配置。');
+  console.error(
+    '常用参数：--base-url --model --responses-model --prompt --size --quality --format --output-compression --timeout-ms --channel-index --channel-id --allow-billable --write-env-file --overwrite'
+  );
+  console.error('不会自动写入 .env.local、重启服务或部署。API Key 仅从 GPT_IMAGE_UPSTREAM_API_KEY 或 OPENAI_API_KEY 读取。');
+}

skills/gpt-image-playground-agent/scripts/lib/channel-capability-matrix.mjs

@@ -0,0 +1,323 @@
+export const CHANNEL_CAPABILITY_REQUEST_MODES = Object.freeze([
+  'images-non-stream',
+  'images-sse',
+  'responses-non-stream',
+  'responses-sse'
+]);
+
+export const DEFAULT_CHANNEL_CAPABILITY_REQUEST_MODE_PRIORITY = Object.freeze([
+  'images-non-stream',
+  'images-sse',
+  'responses-non-stream',
+  'responses-sse'
+]);
+
+const CONTROL_CHARACTER_PATTERN = /[\u0000\r\n]/;
+const SAFE_UNQUOTED_ENV_VALUE_PATTERN = /^[A-Za-z0-9._/:,@%+=-]+$/;
+
+export function resolveUpstreamApiKey(env = process.env) {
+  const preferred = readNonEmptyString(env.GPT_IMAGE_UPSTREAM_API_KEY);
+  if (preferred) return { value: preferred, source: 'GPT_IMAGE_UPSTREAM_API_KEY' };
+
+  const fallback = readNonEmptyString(env.OPENAI_API_KEY);
+  if (fallback) return { value: fallback, source: 'OPENAI_API_KEY' };
+
+  return { value: '', source: undefined };
+}
+
+export function validateChannelApiKey(value) {
+  if (!readNonEmptyString(value)) return { ok: false, reason: 'missing_api_key' };
+  if (CONTROL_CHARACTER_PATTERN.test(value)) return { ok: false, reason: 'invalid_api_key_characters' };
+  if (value.includes(',')) return { ok: false, reason: 'api_key_contains_comma' };
+  return { ok: true };
+}
+
+export function validateChannelId(value) {
+  const normalized = readNonEmptyString(value);
+  if (!normalized) return { ok: false, reason: 'missing_channel_id' };
+  if (!/^[A-Za-z0-9][A-Za-z0-9._-]{0,63}$/.test(normalized)) {
+    return { ok: false, reason: 'invalid_channel_id' };
+  }
+  return { ok: true, value: normalized };
+}
+
+export function createDefaultChannelId(hostname, channelIndex) {
+  const hostPart = String(hostname || 'upstream')
+    .toLowerCase()
+    .replace(/[^a-z0-9]+/g, '-')
+    .replace(/^-+|-+$/g, '')
+    .slice(0, 48);
+  return `channel-${channelIndex}-${hostPart || 'upstream'}`;
+}
+
+export function buildCapabilityMatrix(input) {
+  const report = isRecord(input.probeReport) ? input.probeReport : {};
+  const requestModes = isRecord(report.request_modes) ? report.request_modes : {};
+  const modeReports = isRecord(requestModes.modes) ? requestModes.modes : {};
+  const requested = Array.isArray(requestModes.requested) ? requestModes.requested : [];
+  const modes = {};
+  const passed = [];
+  const failed = [];
+  const skipped = [];
+
+  for (const requestMode of CHANNEL_CAPABILITY_REQUEST_MODES) {
+    const mode = isRecord(modeReports[requestMode]) ? modeReports[requestMode] : undefined;
+    const summary = summarizeMode(requestMode, mode, input.redactText);
+    modes[requestMode] = summary;
+    if (summary.status === 'passed') passed.push(requestMode);
+    else if (summary.status === 'skipped') skipped.push(requestMode);
+    else failed.push(requestMode);
+  }
+
+  const models = summarizePreflight(report.models, input.redactText);
+  const coverageComplete =
+    CHANNEL_CAPABILITY_REQUEST_MODES.every((requestMode) => requested.includes(requestMode)) &&
+    CHANNEL_CAPABILITY_REQUEST_MODES.every((requestMode) => isRecord(modeReports[requestMode]));
+  const responsesModes = passed.filter((requestMode) => requestMode.startsWith('responses-'));
+  const responsesModel = readResponsesModel(modeReports, responsesModes);
+  const imageBackend = resolveDefaultImageBackend(passed);
+  const blockingReasons = [];
+
+  if (!input.allowBillable) blockingReasons.push('billable_verification_required');
+  if (!models.ok) blockingReasons.push('models_preflight_failed');
+  if (!coverageComplete) blockingReasons.push('incomplete_request_mode_matrix');
+  if (!input.apiKeyValid) blockingReasons.push(input.apiKeyError || 'missing_api_key');
+  if (passed.length === 0) blockingReasons.push('no_consumable_image_mode');
+  if (responsesModes.length > 0 && !responsesModel) blockingReasons.push('missing_responses_model');
+
+  return {
+    requested: [...CHANNEL_CAPABILITY_REQUEST_MODES],
+    coverage_complete: coverageComplete,
+    fully_supported: passed.length === CHANNEL_CAPABILITY_REQUEST_MODES.length,
+    passed,
+    failed,
+    skipped,
+    modes,
+    preflight: {
+      dns: summarizePreflight(report.dns, input.redactText),
+      tls: summarizePreflight(report.tls, input.redactText),
+      models
+    },
+    configuration: {
+      ready: blockingReasons.length === 0,
+      blocking_reasons: blockingReasons,
+      request_modes: passed,
+      request_mode_priority: orderRequestModesByDefaultPriority(passed),
+      ...(imageBackend ? { image_backend: imageBackend, streaming_strategy: 'auto' } : {}),
+      responses_backend_required: responsesModes.length > 0,
+      responses_model: responsesModel || undefined
+    }
+  };
+}
+
+export function buildChannelEnvConfig(input) {
+  const channelIndex = readPositiveChannelIndex(input.channelIndex);
+  const channelId = readRequiredEnvValue(input.channelId, 'channel_id');
+  const baseUrl = readRequiredEnvValue(input.baseUrl, 'base_url');
+  const apiKey = readRequiredEnvValue(input.apiKey, 'api_key');
+  const requestModes = normalizeRequestModes(input.requestModes);
+  const requestModePriority = normalizeRequestModes(input.requestModePriority || requestModes);
+  const responsesModel = readNonEmptyString(input.responsesModel);
+  const hasResponsesMode = requestModes.some((requestMode) => requestMode.startsWith('responses-'));
+  const imageBackend = resolveDefaultImageBackend(requestModes);
+  const plainHttpAllowlistValue = resolvePlainHttpAllowlistValue(baseUrl);
+
+  if (hasResponsesMode && !responsesModel) {
+    throw new Error('missing_responses_model');
+  }
+  if (!imageBackend) throw new Error('missing_image_backend');
+
+  const prefix = `OPENAI_CHANNEL_${channelIndex}`;
+  const lines = [
+    '# Generated after a billable upstream capability matrix probe.',
+    '# This file contains credentials. Keep it private and do not commit it.',
+    `${prefix}_ID=${serializeEnvValue(channelId)}`,
+    `${prefix}_BASE_URL=${serializeEnvValue(baseUrl)}`,
+    `${prefix}_API_KEYS=${serializeEnvValue(apiKey)}`,
+    `${prefix}_REQUEST_MODES=${serializeEnvValue(requestModes.join(','))}`,
+    `${prefix}_REQUEST_MODE_PRIORITY=${serializeEnvValue(requestModePriority.join(','))}`,
+    `IMAGE_GENERATION_BACKEND=${serializeEnvValue(imageBackend)}`,
+    'IMAGE_STREAMING_STRATEGY=auto'
+  ];
+
+  if (plainHttpAllowlistValue) {
+    lines.push(`OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS=${serializeEnvValue(plainHttpAllowlistValue)}`);
+  }
+
+  if (hasResponsesMode) {
+    lines.push('ENABLE_RESPONSES_IMAGE_BACKEND=true');
+    lines.push(`OPENAI_RESPONSES_API_MODEL=${serializeEnvValue(responsesModel)}`);
+  }
+
+  return `${lines.join('\n')}\n`;
+}
+
+export function buildRedactedChannelEnvPreview(input) {
+  const channelIndex = readPositiveChannelIndex(input.channelIndex);
+  const requestModes = normalizeRequestModes(input.requestModes);
+  const requestModePriority = normalizeRequestModes(input.requestModePriority || requestModes);
+  const imageBackend = resolveDefaultImageBackend(requestModes);
+  const baseUrl = readRequiredEnvValue(input.baseUrl, 'base_url');
+  const plainHttpAllowlistValue = resolvePlainHttpAllowlistValue(baseUrl);
+  if (!imageBackend) throw new Error('missing_image_backend');
+  const prefix = `OPENAI_CHANNEL_${channelIndex}`;
+  const lines = [
+    `${prefix}_ID=${serializeEnvValue(readRequiredEnvValue(input.channelId, 'channel_id'))}`,
+    `${prefix}_BASE_URL=${serializeEnvValue(baseUrl)}`,
+    `${prefix}_API_KEYS=[redacted]`,
+    `${prefix}_REQUEST_MODES=${serializeEnvValue(requestModes.join(','))}`,
+    `${prefix}_REQUEST_MODE_PRIORITY=${serializeEnvValue(requestModePriority.join(','))}`,
+    `IMAGE_GENERATION_BACKEND=${serializeEnvValue(imageBackend)}`,
+    'IMAGE_STREAMING_STRATEGY=auto'
+  ];
+
+  if (plainHttpAllowlistValue) {
+    lines.push(`OPENAI_ALLOWED_PLAIN_HTTP_API_BASE_URLS=${serializeEnvValue(plainHttpAllowlistValue)}`);
+  }
+
+  if (requestModes.some((requestMode) => requestMode.startsWith('responses-'))) {
+    lines.push('ENABLE_RESPONSES_IMAGE_BACKEND=true');
+    lines.push(`OPENAI_RESPONSES_API_MODEL=${serializeEnvValue(readRequiredEnvValue(input.responsesModel, 'responses_model'))}`);
+  }
+
+  return lines;
+}
+
+export function redactKnownSecrets(value, secrets) {
+  const normalizedSecrets = Array.from(new Set(secrets.map(readNonEmptyString).filter(Boolean)));
+  if (typeof value === 'string') {
+    return normalizedSecrets.reduce((result, secret) => result.split(secret).join('[redacted]'), value);
+  }
+  if (Array.isArray(value)) return value.map((item) => redactKnownSecrets(item, normalizedSecrets));
+  if (!isRecord(value)) return value;
+  return Object.fromEntries(
+    Object.entries(value).map(([key, nestedValue]) => [key, redactKnownSecrets(nestedValue, normalizedSecrets)])
+  );
+}
+
+function summarizeMode(requestMode, mode, redactText) {
+  if (!mode) {
+    return {
+      request_mode: requestMode,
+      status: 'failed',
+      ok: false,
+      billable: false,
+      reason: 'not_reported'
+    };
+  }
+
+  const skipped = mode.skipped === true;
+  const passed = mode.ok === true && !skipped && mode.billable === true;
+  const status = skipped ? 'skipped' : passed ? 'passed' : 'failed';
+  const result = {
+    request_mode: requestMode,
+    status,
+    ok: mode.ok === true,
+    billable: mode.billable === true,
+    ...(skipped ? { skipped: true } : {}),
+    ...(readSafeInteger(mode.status) !== undefined ? { upstream_status: mode.status } : {}),
+    ...(readSafeInteger(mode.elapsed_ms) !== undefined ? { elapsed_ms: mode.elapsed_ms } : {}),
+    ...(readNonEmptyString(mode.category) ? { category: redact(mode.category, redactText) } : {}),
+    ...(readNonEmptyString(mode.reason) ? { reason: redact(mode.reason, redactText) } : {}),
+    ...(readErrorText(mode.error) ? { error: redact(readErrorText(mode.error), redactText) } : {}),
+    ...(mode.has_consumable_image === true ? { has_consumable_image: true } : {}),
+    ...(mode.has_remote_url_result === true ? { has_remote_url_result: true } : {}),
+    ...(mode.has_same_origin_url_result === true ? { has_same_origin_url_result: true } : {})
+  };
+  return result;
+}
+
+function summarizePreflight(value, redactText) {
+  if (!isRecord(value)) return { ok: false, reason: 'not_reported' };
+  return {
+    ok: value.ok === true,
+    ...(value.skipped === true ? { skipped: true } : {}),
+    ...(readSafeInteger(value.status) !== undefined ? { status: value.status } : {}),
+    ...(readSafeInteger(value.elapsed_ms) !== undefined ? { elapsed_ms: value.elapsed_ms } : {}),
+    ...(readNonEmptyString(value.reason) ? { reason: redact(value.reason, redactText) } : {}),
+    ...(readErrorText(value.error) ? { error: redact(readErrorText(value.error), redactText) } : {})
+  };
+}
+
+function readResponsesModel(modeReports, responsesModes) {
+  for (const requestMode of responsesModes) {
+    const model = readNonEmptyString(modeReports[requestMode]?.responses_model);
+    if (model) return model;
+  }
+  return '';
+}
+
+function orderRequestModesByDefaultPriority(requestModes) {
+  const allowed = new Set(requestModes);
+  return DEFAULT_CHANNEL_CAPABILITY_REQUEST_MODE_PRIORITY.filter((requestMode) => allowed.has(requestMode));
+}
+
+function resolveDefaultImageBackend(requestModes) {
+  if (requestModes.some((requestMode) => requestMode.startsWith('images-'))) return 'images-api';
+  if (requestModes.some((requestMode) => requestMode.startsWith('responses-'))) return 'responses-image-generation';
+  return undefined;
+}
+
+function resolvePlainHttpAllowlistValue(baseUrl) {
+  const parsed = new URL(baseUrl);
+  if (parsed.protocol !== 'http:' || isLoopbackHostname(parsed.hostname)) return undefined;
+  return baseUrl;
+}
+
+function isLoopbackHostname(hostname) {
+  const normalized = hostname.toLowerCase();
+  return (
+    normalized === 'localhost' ||
+    normalized === '::1' ||
+    normalized === '[::1]' ||
+    /^127(?:\.\d{1,3}){3}$/.test(normalized)
+  );
+}
+
+function normalizeRequestModes(value) {
+  const modes = Array.isArray(value) ? value : [];
+  const normalized = CHANNEL_CAPABILITY_REQUEST_MODES.filter((requestMode) => modes.includes(requestMode));
+  if (normalized.length === 0) throw new Error('missing_request_modes');
+  return normalized;
+}
+
+function readPositiveChannelIndex(value) {
+  const text = String(value ?? '').trim();
+  if (!/^[1-9]\d*$/.test(text)) throw new Error('invalid_channel_index');
+  const parsed = Number(text);
+  if (!Number.isSafeInteger(parsed)) throw new Error('invalid_channel_index');
+  return parsed;
+}
+
+function readRequiredEnvValue(value, label) {
+  const normalized = readNonEmptyString(value);
+  if (!normalized || CONTROL_CHARACTER_PATTERN.test(normalized)) throw new Error(`invalid_${label}`);
+  return normalized;
+}
+
+function serializeEnvValue(value) {
+  const normalized = readRequiredEnvValue(value, 'env_value');
+  return SAFE_UNQUOTED_ENV_VALUE_PATTERN.test(normalized) ? normalized : JSON.stringify(normalized);
+}
+
+function readSafeInteger(value) {
+  return Number.isSafeInteger(value) && value >= 0 ? value : undefined;
+}
+
+function readErrorText(value) {
+  if (typeof value === 'string') return value;
+  if (isRecord(value) && typeof value.message === 'string') return value.message;
+  return '';
+}
+
+function redact(value, redactText) {
+  return typeof redactText === 'function' ? redactText(value) : value;
+}
+
+function readNonEmptyString(value) {
+  return typeof value === 'string' && value.trim() ? value.trim() : '';
+}
+
+function isRecord(value) {
+  return Boolean(value) && typeof value === 'object' && !Array.isArray(value);
+}

src/app/api/agent/agent-routes.test.ts

@@ -59,6 +59,7 @@ beforeEach(async () => {
     delete process.env.OPENAI_API_BASE_URL;
     delete process.env.OPENAI_UPSTREAM_REQUEST_MODES;
     delete process.env.OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY;
+    delete process.env.OPENAI_UPSTREAM_PROXY_URL;
     delete process.env.OPENAI_UPSTREAM_USER_AGENT;
     delete process.env.UPSTREAM_USER_AGENT;
     delete process.env.OPENAI_CHANNEL_1_ID;
@@ -157,6 +158,7 @@ describe('Agent route integration', () => {
         assert.deepEqual(body.upstream_request_headers.channels, [
             {
                 id: 'matsca',
+                upstream_proxy: { configured: false },
                 request_modes: ['images-non-stream'],
                 request_mode_priority: ['images-non-stream'],
                 request_headers: {
@@ -211,6 +213,7 @@ describe('Agent route integration', () => {
         assert.deepEqual(body.upstream_request_headers.channels, [
             {
                 id: 'default',
+                upstream_proxy: { configured: false },
                 request_modes: ['images-non-stream', 'images-sse'],
                 request_mode_priority: ['images-sse', 'images-non-stream'],
                 request_headers: {
@@ -223,6 +226,40 @@ describe('Agent route integration', () => {
         ]);
     });
 
+    it('reports global and per-channel upstream proxy summaries without exposing endpoints', async () => {
+        const { getCapabilities } = await loadAgentRoutes();
+        process.env.OPENAI_UPSTREAM_PROXY_URL = 'https://global-proxy.integration.example:9443';
+        process.env.OPENAI_CHANNEL_1_ID = 'primary';
+        process.env.OPENAI_CHANNEL_1_BASE_URL = 'https://primary.example.com/v1';
+        process.env.OPENAI_CHANNEL_1_API_KEYS = 'primary-secret';
+        process.env.OPENAI_CHANNEL_2_ID = 'backup';
+        process.env.OPENAI_CHANNEL_2_BASE_URL = 'https://backup.example.com/v1';
+        process.env.OPENAI_CHANNEL_2_API_KEYS = 'backup-secret';
+        process.env.OPENAI_CHANNEL_2_PROXY_URL = 'http://channel-proxy.integration.example:8080';
+
+        const response = await getCapabilities();
+        assert.equal(response.status, 200);
+        const body = await response.json();
+        assert.deepEqual(body.image_transport.upstream_proxy, { configured: true, protocol: 'https' });
+        assert.deepEqual(
+            body.upstream_request_headers.channels.map((channel: { id: string; upstream_proxy: unknown }) => ({
+                id: channel.id,
+                upstream_proxy: channel.upstream_proxy
+            })),
+            [
+                { id: 'primary', upstream_proxy: { configured: true, protocol: 'https' } },
+                { id: 'backup', upstream_proxy: { configured: true, protocol: 'http' } }
+            ]
+        );
+        const serialized = JSON.stringify(body);
+        assert.equal(serialized.includes('global-proxy.integration.example'), false);
+        assert.equal(serialized.includes('channel-proxy.integration.example'), false);
+        assert.equal(serialized.includes('9443'), false);
+        assert.equal(serialized.includes('8080'), false);
+        assert.equal(serialized.includes('primary-secret'), false);
+        assert.equal(serialized.includes('backup-secret'), false);
+    });
+
     it('registers cleanup-managed artifacts for every request mode', async () => {
         const { generateImage } = await loadAgentRoutes();
         const { getAgentStateStore } = await import('@/lib/agent-state-runtime');
@@ -389,6 +426,7 @@ describe('Agent route integration', () => {
         assert.deepEqual(body.upstream_request_headers.channels, [
             {
                 id: 'matsca',
+                upstream_proxy: { configured: false },
                 request_modes: ['images-non-stream'],
                 request_mode_priority: ['images-non-stream'],
                 request_headers: {

src/app/api/agent/capabilities/route.ts

@@ -31,6 +31,7 @@ function readPublicCapabilitiesEnv(): Record<string, string | undefined> {
         OPENAI_UPSTREAM_PROFILE: process.env.OPENAI_UPSTREAM_PROFILE,
         OPENAI_UPSTREAM_REQUEST_MODES: process.env.OPENAI_UPSTREAM_REQUEST_MODES,
         OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY: process.env.OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY,
+        OPENAI_UPSTREAM_PROXY_URL: process.env.OPENAI_UPSTREAM_PROXY_URL,
         OPENAI_UPSTREAM_USER_AGENT: readConfiguredMarker(process.env.OPENAI_UPSTREAM_USER_AGENT),
         UPSTREAM_USER_AGENT: readConfiguredMarker(process.env.UPSTREAM_USER_AGENT),
         OPENAI_ROUTING_STRATEGY: process.env.OPENAI_ROUTING_STRATEGY,
@@ -46,7 +47,7 @@ function readPublicChannelEnv(env: NodeJS.ProcessEnv): Record<string, string | u
     const publicEnv: Record<string, string | undefined> = {};
     for (const key of Object.keys(env)) {
         const match =
-            /^OPENAI_CHANNEL_(\d+)_(ID|BASE_URL|UPSTREAM_PROFILE|PROVIDER_MANIFEST|REQUEST_MODES|REQUEST_MODE_PRIORITY|API_KEYS|MATSCA_APP_ID|MATSCA_APP_SECRET|USER_AGENT|UPSTREAM_HEADERS_JSON)$/.exec(
+            /^OPENAI_CHANNEL_(\d+)_(ID|BASE_URL|PROXY_URL|UPSTREAM_PROFILE|PROVIDER_MANIFEST|REQUEST_MODES|REQUEST_MODE_PRIORITY|API_KEYS|MATSCA_APP_ID|MATSCA_APP_SECRET|USER_AGENT|UPSTREAM_HEADERS_JSON)$/.exec(
                 key
             );
         if (!match) continue;

src/app/api/agent/diagnostics/channel-health/route.test.ts

@@ -19,6 +19,8 @@ beforeEach(() => {
     process.env.OPENAI_CHANNEL_1_BASE_URL = 'https://images.example.test/v1';
     process.env.OPENAI_CHANNEL_1_API_KEYS = 'health-channel-secret,secondary-secret';
     process.env.OPENAI_CHANNEL_1_REQUEST_MODES = 'images-non-stream,images-sse';
+    delete process.env.OPENAI_UPSTREAM_PROXY_URL;
+    delete process.env.OPENAI_CHANNEL_1_PROXY_URL;
     resetServerChannelStateForTests();
 });
 
@@ -104,6 +106,7 @@ describe('GET /api/agent/diagnostics/channel-health', () => {
             channels: [
                 {
                     channel_id: 'primary',
+                    upstream_proxy: { configured: false },
                     credential_count: 2,
                     healthy_credential_count: 1,
                     unhealthy_credential_count: 1,

src/app/api/agent/diagnostics/channel-health/route.ts

@@ -33,6 +33,7 @@ function toPublicChannelHealthSnapshot(snapshot: ChannelHealthSnapshot) {
         observed_at: snapshot.at,
         channels: snapshot.channels.map((channel) => ({
             channel_id: channel.channelId,
+            upstream_proxy: channel.upstreamProxy,
             credential_count: channel.credentialCount,
             healthy_credential_count: channel.healthyCredentialCount,
             unhealthy_credential_count: channel.unhealthyCredentialCount,

src/app/api/deploy-marker/route.ts

@@ -1,6 +1,6 @@
 import { NextResponse } from 'next/server';
 
-const deployMarker = {"schema_version":1,"local_sha":"7db5c07cd25ba69e829f2561814fec0a1a73e7e8","created_at":"2026-07-23T14:28:33.665Z","deploy_id":"e28ac5a2-35c9-4be8-a553-2f3632c02d2e"} as const;
+const deployMarker = {"schema_version":1,"local_sha":"4770498acf64bbcda373c6a220f5b5781cef6136","created_at":"2026-07-25T04:50:43.340Z","deploy_id":"28984fcf-867f-419f-bc4c-22acd7ba92c9"} as const;
 
 export const dynamic = 'force-dynamic';
 

src/app/api/images/route-defaults.test.ts

@@ -2,6 +2,7 @@ import {
     PNG_BASE64,
     imageFormRequest,
     readSseEvents,
+    startHttpConnectProxy,
     startImagesJsonUpstream,
     startResponsesImageUpstream,
     startStreamingImageUpstream,
@@ -111,6 +112,62 @@ describe('POST /api/images backend defaults and security boundaries', { concurre
         }
     });
 
+    it('sends page API requests through the configured global upstream proxy', async () => {
+        const { POST } = await import('./route');
+        const upstream = await startImagesJsonUpstream(async () => ({ data: [{ b64_json: PNG_BASE64 }] }));
+        const proxy = await startHttpConnectProxy();
+        process.env.OPENAI_UPSTREAM_PROXY_URL = proxy.url;
+
+        try {
+            const response = await POST(
+                imageFormRequest({
+                    apiBaseUrl: upstream.baseUrl,
+                    apiKey: 'test-key',
+                    stream: false,
+                    streamMode: 'non_stream'
+                })
+            );
+
+            assert.equal(response.status, 200);
+            assert.ok(proxy.connectTargets.length > 0);
+            assert.ok(proxy.connectTargets.every((target) => target === new URL(upstream.baseUrl).host));
+        } finally {
+            await proxy.close();
+            await upstream.close();
+        }
+    });
+
+    it('uses a channel proxy instead of the global upstream proxy', async () => {
+        const { POST } = await import('./route');
+        const upstream = await startImagesJsonUpstream(async () => ({ data: [{ b64_json: PNG_BASE64 }] }));
+        const globalProxy = await startHttpConnectProxy();
+        const channelProxy = await startHttpConnectProxy();
+        process.env.OPENAI_UPSTREAM_PROXY_URL = globalProxy.url;
+        process.env.OPENAI_CHANNEL_1_ID = 'proxied-channel';
+        process.env.OPENAI_CHANNEL_1_BASE_URL = upstream.baseUrl;
+        process.env.OPENAI_CHANNEL_1_API_KEYS = 'channel-key';
+        process.env.OPENAI_CHANNEL_1_PROXY_URL = channelProxy.url;
+        process.env.OPENAI_CHANNEL_1_REQUEST_MODES = 'images-non-stream';
+
+        try {
+            const response = await POST(
+                imageFormRequest({
+                    stream: false,
+                    streamMode: 'non_stream'
+                })
+            );
+
+            assert.equal(response.status, 200);
+            assert.ok(channelProxy.connectTargets.length > 0);
+            assert.ok(channelProxy.connectTargets.every((target) => target === new URL(upstream.baseUrl).host));
+            assert.deepEqual(globalProxy.connectTargets, []);
+        } finally {
+            await channelProxy.close();
+            await globalProxy.close();
+            await upstream.close();
+        }
+    });
+
     it('rejects cross-origin GPT2Image URL results before downloading them', async () => {
         const { POST } = await import('./route');
         const upstream = await startImagesJsonUpstream(async () => {

src/app/api/images/route-test-helpers.ts

@@ -1,6 +1,7 @@
 import type { NextRequest } from 'next/server';
 import assert from 'node:assert/strict';
 import http from 'node:http';
+import net from 'node:net';
 
 export { readSseEvents } from '@/lib/sse-test-utils';
 
@@ -405,6 +406,56 @@ export async function startStreamingResponsesImageUpstream(
     return listen(server);
 }
 
+export async function startHttpConnectProxy(): Promise<{
+    url: string;
+    connectTargets: string[];
+    close: () => Promise<void>;
+}> {
+    const sockets = new Set<net.Socket>();
+    const connectTargets: string[] = [];
+    const server = http.createServer((_request, response) => {
+        response.writeHead(405, { Connection: 'close' });
+        response.end();
+    });
+    server.on('connection', (socket) => {
+        sockets.add(socket);
+        socket.on('close', () => sockets.delete(socket));
+    });
+    server.on('connect', (request, clientSocket, head) => {
+        const target = parseConnectTarget(request.url);
+        if (!target) {
+            clientSocket.end('HTTP/1.1 400 Bad Request\r\nConnection: close\r\n\r\n');
+            return;
+        }
+        connectTargets.push(target.host);
+        const targetSocket = net.connect({ host: target.hostname, port: Number(target.port) });
+        sockets.add(targetSocket);
+        targetSocket.on('close', () => sockets.delete(targetSocket));
+        targetSocket.once('connect', () => {
+            clientSocket.write('HTTP/1.1 200 Connection Established\r\n\r\n');
+            if (head.length > 0) targetSocket.write(head);
+            clientSocket.pipe(targetSocket);
+            targetSocket.pipe(clientSocket);
+        });
+        targetSocket.once('error', () => {
+            if (!clientSocket.destroyed) {
+                clientSocket.end('HTTP/1.1 502 Bad Gateway\r\nConnection: close\r\n\r\n');
+            }
+        });
+    });
+    await new Promise<void>((resolve, reject) => {
+        server.once('error', reject);
+        server.listen(0, '127.0.0.1', resolve);
+    });
+    const address = server.address();
+    assert.ok(address && typeof address === 'object');
+    return {
+        url: `http://127.0.0.1:${address.port}`,
+        connectTargets,
+        close: () => closeServerWithSockets(server, sockets)
+    };
+}
+
 async function listen(server: http.Server): Promise<{ baseUrl: string; close: () => Promise<void> }> {
     await new Promise<void>((resolve) => server.listen(0, '127.0.0.1', resolve));
     const address = server.address();
@@ -414,3 +465,22 @@ async function listen(server: http.Server): Promise<{ baseUrl: string; close: ()
         close: () => new Promise((resolve, reject) => server.close((error) => (error ? reject(error) : resolve())))
     };
 }
+
+function parseConnectTarget(rawTarget: string | undefined): URL | undefined {
+    if (!rawTarget) return undefined;
+    try {
+        return new URL(`http://${rawTarget}`);
+    } catch {
+        return undefined;
+    }
+}
+
+async function closeServerWithSockets(server: http.Server, sockets: Set<net.Socket>): Promise<void> {
+    for (const socket of sockets) socket.destroy();
+    await new Promise<void>((resolve, reject) => {
+        server.close((error) => {
+            if (error) reject(error);
+            else resolve();
+        });
+    });
+}

src/app/api/images/route-test-setup.ts

@@ -16,6 +16,7 @@ export function registerRouteTestLifecycle() {
         delete process.env.APP_PASSWORD;
         delete process.env.OPENAI_API_KEY;
         delete process.env.OPENAI_API_BASE_URL;
+        delete process.env.OPENAI_UPSTREAM_PROXY_URL;
         delete process.env.OPENAI_CHANNEL_1_ID;
         delete process.env.OPENAI_CHANNEL_1_API_KEYS;
         delete process.env.OPENAI_CHANNEL_1_BASE_URL;

src/app/api/images/route.ts

@@ -427,6 +427,7 @@ export async function POST(request: NextRequest) {
         const {
             apiKey: effectiveApiKey,
             baseUrl: effectiveApiBaseUrl,
+            upstreamProxyUrl: effectiveUpstreamProxyUrl,
             upstreamProfile: effectiveUpstreamProfileId,
             providerProfile,
             upstreamHeaders,
@@ -435,6 +436,7 @@ export async function POST(request: NextRequest) {
             requestApiKey,
             requestApiBaseUrl,
             legacyBaseUrl: process.env.OPENAI_API_BASE_URL,
+            legacyUpstreamProxyUrl: process.env.OPENAI_UPSTREAM_PROXY_URL,
             selectedCredential: selectedServerCredential
         });
         validateApiBaseUrl(effectiveApiBaseUrl || '', { allowedPlainHttpBaseUrls });
@@ -461,6 +463,7 @@ export async function POST(request: NextRequest) {
             createOpenAIImageClientOptions({
                 apiKey: effectiveApiKey,
                 baseURL: effectiveApiBaseUrl || undefined,
+                upstreamProxyUrl: effectiveUpstreamProxyUrl,
                 defaultHeaders: mergeUpstreamHeadersWithFixed(upstreamHeaders, {})
             })
         );
@@ -577,6 +580,7 @@ export async function POST(request: NextRequest) {
                       storageMode: effectiveStorageMode,
                       apiBaseUrl: effectiveApiBaseUrl,
                       apiKey: effectiveApiKey,
+                      upstreamProxyUrl: effectiveUpstreamProxyUrl,
                       startedAtMs: upstreamStartedAtMs,
                       upstreamIdempotencyKey,
                       clientRequestId,
@@ -609,6 +613,7 @@ export async function POST(request: NextRequest) {
                       storageMode: effectiveStorageMode,
                       apiBaseUrl: effectiveApiBaseUrl,
                       apiKey: effectiveApiKey,
+                      upstreamProxyUrl: effectiveUpstreamProxyUrl,
                       startedAtMs: upstreamStartedAtMs,
                       upstreamIdempotencyKey,
                       clientRequestId,
@@ -647,6 +652,7 @@ export async function POST(request: NextRequest) {
                 normalizeOutputFormat: true,
                 apiBaseUrl: effectiveApiBaseUrl,
                 apiKey: effectiveApiKey,
+                upstreamProxyUrl: effectiveUpstreamProxyUrl,
                 upstreamHeaders,
                 abortSignal: request.signal
             });
@@ -657,6 +663,7 @@ export async function POST(request: NextRequest) {
             const actualCost = await resolveRequestActualCostSafely({
                 apiBaseUrl: effectiveApiBaseUrl,
                 apiKey: effectiveApiKey,
+                upstreamProxyUrl: effectiveUpstreamProxyUrl,
                 model,
                 startedAtMs: upstreamStartedAtMs,
                 expectedImageCount: savedImagesData.length,

src/app/api/runtime-capabilities/route.test.ts

@@ -33,6 +33,7 @@ beforeEach(async () => {
     delete process.env.IMAGE_UPSTREAM_TIMEOUT_MS;
     delete process.env.IMAGE_STREAM_DATA_INTERVAL_TIMEOUT_MS;
     delete process.env.IMAGE_UPSTREAM_MAX_RETRIES;
+    delete process.env.OPENAI_UPSTREAM_PROXY_URL;
     delete process.env.OPENAI_API_KEY;
     delete process.env.OPENAI_API_BASE_URL;
     delete process.env.OPENAI_ROUTING_STRATEGY;
@@ -43,6 +44,7 @@ beforeEach(async () => {
     delete process.env.OPENAI_CHANNEL_1_PROVIDER_MANIFEST;
     delete process.env.OPENAI_CHANNEL_1_REQUEST_MODES;
     delete process.env.OPENAI_CHANNEL_1_REQUEST_MODE_PRIORITY;
+    delete process.env.OPENAI_CHANNEL_1_PROXY_URL;
     delete process.env.OPENAI_CHANNEL_2_ID;
     delete process.env.OPENAI_CHANNEL_2_API_KEYS;
     delete process.env.OPENAI_CHANNEL_2_BASE_URL;
@@ -50,6 +52,7 @@ beforeEach(async () => {
     delete process.env.OPENAI_CHANNEL_2_PROVIDER_MANIFEST;
     delete process.env.OPENAI_CHANNEL_2_REQUEST_MODES;
     delete process.env.OPENAI_CHANNEL_2_REQUEST_MODE_PRIORITY;
+    delete process.env.OPENAI_CHANNEL_2_PROXY_URL;
     delete process.env.OPENAI_CHANNEL_FAILURE_COOLDOWN_ENABLED;
     delete process.env.OPENAI_CHANNEL_QUEUE_ENABLED;
     delete process.env.OPENAI_CHANNEL_QUEUE_MAX_WAIT_MS;
@@ -215,6 +218,7 @@ describe('GET /api/runtime-capabilities', { concurrency: false }, () => {
                 upstream_timeout_ms?: number;
                 stream_data_interval_timeout_ms?: number;
                 upstream_max_retries?: number;
+                upstream_proxy?: { configured: boolean; protocol?: string };
             }
         >;
 
@@ -224,7 +228,8 @@ describe('GET /api/runtime-capabilities', { concurrency: false }, () => {
         assert.deepEqual(body.imageTransport, {
             upstream_timeout_ms: 1_200_000,
             stream_data_interval_timeout_ms: 600_000,
-            upstream_max_retries: 1
+            upstream_max_retries: 1,
+            upstream_proxy: { configured: false }
         });
     });
 
@@ -612,6 +617,10 @@ describe('GET /api/runtime-capabilities', { concurrency: false }, () => {
                     configuredChannelCount: number;
                     healthyChannelCount: number;
                 }>;
+                upstreamProxyByChannel: Array<{
+                    channelId: string;
+                    upstreamProxy: { configured: boolean; protocol?: string };
+                }>;
                 requestModesByChannel: Array<{
                     channelId: string;
                     requestModes: string[];
@@ -689,6 +698,12 @@ describe('GET /api/runtime-capabilities', { concurrency: false }, () => {
                     healthyChannelCount: 0
                 }
             ],
+            upstreamProxyByChannel: [
+                {
+                    channelId: 'images',
+                    upstreamProxy: { configured: false }
+                }
+            ],
             requestModesByChannel: [
                 {
                     channelId: 'images',

src/app/api/runtime-capabilities/route.ts

@@ -98,6 +98,10 @@ export async function GET() {
                     CHANNEL_REQUEST_MODE_ADMIN_CONTROL.defaultPriority,
                 requestModeControls: CHANNEL_REQUEST_MODE_ADMIN_CONTROL,
                 requestModeHealth: requestModeHealthSummary?.modes ?? [],
+                upstreamProxyByChannel: summary.channels.map((channel) => ({
+                    channelId: channel.id,
+                    upstreamProxy: channel.upstreamProxy
+                })),
                 requestModesByChannel: summary.channels.map((channel) => ({
                     channelId: channel.id,
                     requestModes: channel.requestModes,

src/lib/agent-api-contracts.test.ts

@@ -394,7 +394,8 @@ describe('buildAgentCapabilities', () => {
         assert.deepEqual(capabilities.image_transport, {
             upstream_timeout_ms: 900_000,
             stream_data_interval_timeout_ms: 900_000,
-            upstream_max_retries: 0
+            upstream_max_retries: 0,
+            upstream_proxy: { configured: false }
         });
         assert.equal(capabilities.defaults.image_backend, 'images-api');
         assert.equal(capabilities.defaults.stream_mode, 'auto');
@@ -713,6 +714,7 @@ describe('buildAgentCapabilities', () => {
         assert.deepEqual(capabilities.upstream_request_headers.channels, [
             {
                 id: 'images',
+                upstream_proxy: { configured: false },
                 request_modes: ['images-non-stream', 'images-sse'],
                 request_mode_priority: ['images-non-stream', 'images-sse'],
                 request_headers: {
@@ -725,6 +727,36 @@ describe('buildAgentCapabilities', () => {
         ]);
     });
 
+    it('reports global and per-channel upstream proxy summaries without exposing endpoints', () => {
+        const capabilities = buildAgentCapabilities({
+            OPENAI_UPSTREAM_PROXY_URL: 'https://global-proxy.internal.example:9443',
+            OPENAI_CHANNEL_1_ID: 'primary',
+            OPENAI_CHANNEL_1_BASE_URL: 'https://primary.example.com/v1',
+            OPENAI_CHANNEL_1_API_KEYS: 'configured',
+            OPENAI_CHANNEL_2_ID: 'backup',
+            OPENAI_CHANNEL_2_BASE_URL: 'https://backup.example.com/v1',
+            OPENAI_CHANNEL_2_API_KEYS: 'configured',
+            OPENAI_CHANNEL_2_PROXY_URL: 'http://channel-proxy.internal.example:8080'
+        });
+
+        assert.deepEqual(capabilities.image_transport.upstream_proxy, { configured: true, protocol: 'https' });
+        assert.deepEqual(
+            capabilities.upstream_request_headers.channels.map((channel) => ({
+                id: channel.id,
+                upstream_proxy: channel.upstream_proxy
+            })),
+            [
+                { id: 'primary', upstream_proxy: { configured: true, protocol: 'https' } },
+                { id: 'backup', upstream_proxy: { configured: true, protocol: 'http' } }
+            ]
+        );
+        const serialized = JSON.stringify(capabilities);
+        assert.equal(serialized.includes('global-proxy.internal.example'), false);
+        assert.equal(serialized.includes('channel-proxy.internal.example'), false);
+        assert.equal(serialized.includes('9443'), false);
+        assert.equal(serialized.includes('8080'), false);
+    });
+
     it('reports Matsca server-channel upload and image-count limits in Agent capabilities', () => {
         const capabilities = buildAgentCapabilities({
             OPENAI_CHANNEL_1_ID: 'matsca',
@@ -989,6 +1021,7 @@ describe('buildAgentCapabilities', () => {
         assert.ok('AgentImageResponseTiming' in document.components.schemas);
         assert.ok('AgentImageResponseExecution' in document.components.schemas);
         assert.ok('ChannelRequestModeDecision' in document.components.schemas);
+        assert.ok('UpstreamProxySummary' in document.components.schemas);
         assert.deepEqual(document.components.schemas.AgentImageResponseExecution.properties.channel_request_mode.enum, [
             'images-non-stream',
             'images-sse',
@@ -1108,6 +1141,11 @@ describe('buildAgentCapabilities', () => {
             document.components.schemas.ImageTransportCapabilities.properties.upstream_timeout_ms.const,
             900000
         );
+        assert.equal(
+            document.components.schemas.ImageTransportCapabilities.properties.upstream_proxy.$ref,
+            '#/components/schemas/UpstreamProxySummary'
+        );
+        assert.deepEqual(document.components.schemas.UpstreamProxySummary.required, ['configured']);
         assert.equal(
             capabilityProperties.upstream_request_headers.properties.default.$ref,
             '#/components/schemas/UpstreamRequestHeaderSummary'

src/lib/agent-api-contracts.ts

@@ -36,7 +36,7 @@ import {
     type ImageStreamMode,
     type ImageStreamingStrategy
 } from './image-upstream-strategy';
-import { summarizeOpenAIImageTransport } from './openai-image-transport';
+import { summarizeOpenAIImageTransport, type UpstreamProxySummary } from './openai-image-transport';
 import { CHINESE_POSITIVE_INTEGER_MESSAGES, readPositiveIntegerFromEnv } from './positive-integer-config.mjs';
 import { readBooleanEnv } from './server-runtime';
 import {
@@ -237,12 +237,14 @@ export type AgentCapabilities = {
         upstream_timeout_ms: number;
         stream_data_interval_timeout_ms: number;
         upstream_max_retries: number;
+        upstream_proxy: UpstreamProxySummary;
     };
     upstream_profile: ImageUpstreamProfileSummary;
     upstream_request_headers: {
         default: UpstreamRequestHeaderSummary;
         channels: Array<{
             id: string;
+            upstream_proxy: UpstreamProxySummary;
             request_modes: readonly ChannelRequestMode[];
             request_mode_priority: readonly ChannelRequestMode[];
             request_headers: UpstreamRequestHeaderSummary;
@@ -1331,6 +1333,7 @@ function buildAgentUpstreamRequestHeadersCapabilities(
         default: summarizeUpstreamRequestHeaders(undefined, env),
         channels: channelSummary.channels.map((channel) => ({
             id: channel.id,
+            upstream_proxy: channel.upstreamProxy,
             request_modes: channel.requestModes,
             request_mode_priority: channel.requestModePriority,
             request_headers: channel.requestHeaders

src/lib/agent-image-service.ts

@@ -118,6 +118,7 @@ type CredentialContext = {
     channelRequestModeDecision: ChannelRequestModeDecision;
     baseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     upstreamProfile: ImageUpstreamProfile;
     upstreamHeaders?: UpstreamRequestHeaders;
 };
@@ -469,6 +470,7 @@ export async function executeAgentGenerate(options: {
             cached: options.cached,
             apiBaseUrl: credentialContext.baseUrl,
             apiKey: credentialContext.apiKey,
+            upstreamProxyUrl: credentialContext.upstreamProxyUrl,
             upstreamHeaders: credentialContext.upstreamHeaders,
             execution: {
                 startedAtMs,
@@ -559,6 +561,7 @@ async function executeAgentGenerateUpstream(
         const stream = await createImagesApiGenerateStream({
             apiBaseUrl: credentialContext.baseUrl,
             apiKey: credentialContext.apiKey,
+            upstreamProxyUrl: credentialContext.upstreamProxyUrl,
             upstreamHeaders: credentialContext.upstreamHeaders,
             idempotencyKey,
             abortSignal,
@@ -571,6 +574,7 @@ async function executeAgentGenerateUpstream(
         return await collectOpenAiImagesFromStream(stream, {
             apiBaseUrl: credentialContext.baseUrl,
             apiKey: credentialContext.apiKey,
+            upstreamProxyUrl: credentialContext.upstreamProxyUrl,
             upstreamHeaders: credentialContext.upstreamHeaders,
             abortSignal,
             onStreamingDegraded: (reason) => markAgentStreamingUnavailable(streamOptions, reason, 200)
@@ -667,6 +671,7 @@ async function executeAgentResponsesGenerate(
             {
                 apiBaseUrl: credentialContext.baseUrl,
                 apiKey: credentialContext.apiKey,
+                upstreamProxyUrl: credentialContext.upstreamProxyUrl,
                 upstreamHeaders: credentialContext.upstreamHeaders,
                 abortSignal,
                 onStreamingDegraded: (reason) => markAgentStreamingUnavailable(streamOptions, reason, 200)
@@ -837,6 +842,7 @@ export async function executeAgentEdit(options: {
             cached: options.cached,
             apiBaseUrl: activeCredentialContext.baseUrl,
             apiKey: activeCredentialContext.apiKey,
+            upstreamProxyUrl: activeCredentialContext.upstreamProxyUrl,
             upstreamHeaders: activeCredentialContext.upstreamHeaders,
             execution: {
                 startedAtMs,
@@ -900,6 +906,7 @@ async function executeAgentEditStream(input: {
         return await collectOpenAiImagesFromStream(stream, {
             apiBaseUrl: input.credentialContext.baseUrl,
             apiKey: input.credentialContext.apiKey,
+            upstreamProxyUrl: input.credentialContext.upstreamProxyUrl,
             upstreamHeaders: input.credentialContext.upstreamHeaders,
             abortSignal: input.abortSignal,
             onStreamingDegraded: (reason) => markAgentStreamingUnavailable(input.streamOptions, reason, 200)
@@ -1072,12 +1079,14 @@ function createOpenAiClient(headers: Headers, requestModePlan: AgentChannelReque
     const {
         apiKey,
         baseUrl,
+        upstreamProxyUrl,
         providerProfile,
         selectedCredential: effectiveSelectedCredential
     } = resolveEffectiveCredential({
         requestApiKey: '',
         requestApiBaseUrl: '',
         legacyBaseUrl: process.env.OPENAI_API_BASE_URL,
+        legacyUpstreamProxyUrl: process.env.OPENAI_UPSTREAM_PROXY_URL,
         selectedCredential
     });
     validateApiBaseUrl(baseUrl || '', {
@@ -1105,6 +1114,7 @@ function createOpenAiClient(headers: Headers, requestModePlan: AgentChannelReque
             createOpenAIImageClientOptions({
                 apiKey,
                 baseURL: baseUrl || undefined,
+                upstreamProxyUrl,
                 defaultHeaders: mergeUpstreamHeadersWithFixed(effectiveSelectedCredential?.upstreamHeaders, {})
             })
         ),
@@ -1114,6 +1124,7 @@ function createOpenAiClient(headers: Headers, requestModePlan: AgentChannelReque
         channelRequestModeDecision,
         baseUrl,
         apiKey,
+        upstreamProxyUrl,
         upstreamProfile:
             providerProfile ||
             readImageUpstreamProfile({
@@ -1230,6 +1241,7 @@ async function persistOpenAiImages(options: {
     cached: boolean;
     apiBaseUrl?: string;
     apiKey?: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     execution: AgentExecutionMetadata;
     abortSignal?: AbortSignal;
@@ -1244,6 +1256,7 @@ async function persistOpenAiImages(options: {
             normalizeOutputFormat: options.normalizeOutputFormat,
             apiBaseUrl: options.apiBaseUrl,
             apiKey: options.apiKey,
+            upstreamProxyUrl: options.upstreamProxyUrl,
             upstreamHeaders: options.upstreamHeaders,
             abortSignal: options.abortSignal
         });

src/lib/agent-openapi.ts

@@ -504,9 +504,16 @@ export function buildAgentOpenApiDocument(env: Record<string, string | undefined
                                     type: 'array',
                                     items: {
                                         type: 'object',
-                                        required: ['id', 'request_modes', 'request_mode_priority', 'request_headers'],
+                                        required: [
+                                            'id',
+                                            'upstream_proxy',
+                                            'request_modes',
+                                            'request_mode_priority',
+                                            'request_headers'
+                                        ],
                                         properties: {
                                             id: { type: 'string' },
+                                            upstream_proxy: { $ref: '#/components/schemas/UpstreamProxySummary' },
                                             request_modes: {
                                                 type: 'array',
                                                 items: { type: 'string', enum: CHANNEL_REQUEST_MODES }
@@ -1079,10 +1086,12 @@ export function buildAgentOpenApiDocument(env: Record<string, string | undefined
                         'unhealthy_credential_count',
                         'state',
                         'probe_required',
+                        'upstream_proxy',
                         'credentials'
                     ],
                     properties: {
                         channel_id: { type: 'string' },
+                        upstream_proxy: { $ref: '#/components/schemas/UpstreamProxySummary' },
                         credential_count: { type: 'integer', minimum: 0 },
                         healthy_credential_count: { type: 'integer', minimum: 0 },
                         unhealthy_credential_count: { type: 'integer', minimum: 0 },
@@ -2197,7 +2206,12 @@ export function buildAgentOpenApiDocument(env: Record<string, string | undefined
                 },
                 ImageTransportCapabilities: {
                     type: 'object',
-                    required: ['upstream_timeout_ms', 'stream_data_interval_timeout_ms', 'upstream_max_retries'],
+                    required: [
+                        'upstream_timeout_ms',
+                        'stream_data_interval_timeout_ms',
+                        'upstream_max_retries',
+                        'upstream_proxy'
+                    ],
                     properties: {
                         upstream_timeout_ms: {
                             type: 'integer',
@@ -2213,9 +2227,21 @@ export function buildAgentOpenApiDocument(env: Record<string, string | undefined
                             type: 'integer',
                             minimum: 0,
                             const: capabilities.image_transport.upstream_max_retries
+                        },
+                        upstream_proxy: {
+                            $ref: '#/components/schemas/UpstreamProxySummary'
                         }
                     },
                     additionalProperties: false
+                },
+                UpstreamProxySummary: {
+                    type: 'object',
+                    required: ['configured'],
+                    properties: {
+                        configured: { type: 'boolean' },
+                        protocol: { type: 'string', enum: ['http', 'https'] }
+                    },
+                    additionalProperties: false
                 }
             }
         }

src/lib/channel-health-prober.ts

@@ -6,6 +6,7 @@ import {
     type ChannelRouter
 } from './channel-router';
 import { mergeUpstreamHeadersWithFixed } from './image-upstream-profile';
+import { fetchOpenAIUpstream } from './openai-image-transport';
 
 type ProbeFetch = (input: URL, init: RequestInit) => Promise<Response>;
 type ProbeResult = {
@@ -69,14 +70,18 @@ export async function probeChannelModelsEndpoint(input: {
     const abortController = new AbortController();
     const timeout = setTimeout(() => abortController.abort(), input.timeoutMs);
     try {
-        const response = await (input.fetchImpl || fetch)(buildModelsUrl(input.credential.baseUrl), {
+        const requestInit = {
             method: 'GET',
             headers: mergeUpstreamHeadersWithFixed(input.credential.upstreamHeaders, {
                 Authorization: `Bearer ${input.credential.apiKey}`,
                 Accept: 'application/json'
             }),
             signal: abortController.signal
-        });
+        } satisfies RequestInit;
+        const targetUrl = buildModelsUrl(input.credential.baseUrl);
+        const response = input.fetchImpl
+            ? await input.fetchImpl(targetUrl, requestInit)
+            : await fetchOpenAIUpstream(targetUrl, requestInit, input.credential.upstreamProxyUrl);
         if (!response.ok) {
             return {
                 ok: false,

src/lib/channel-health-snapshot.test.ts

@@ -35,6 +35,7 @@ describe('channel health snapshot', () => {
             channels: [
                 {
                     channelId: 'primary',
+                    upstreamProxy: { configured: false },
                     credentialCount: 2,
                     healthyCredentialCount: 1,
                     unhealthyCredentialCount: 1,

src/lib/channel-router.test.ts

@@ -83,6 +83,61 @@ describe('parseChannelPoolConfig', () => {
         ]);
     });
 
+    it('applies the global proxy and lets a numbered channel override it', () => {
+        const config = parseChannelPoolConfig({
+            OPENAI_UPSTREAM_PROXY_URL: 'https://global-proxy.example:8443',
+            OPENAI_CHANNEL_1_ID: 'primary',
+            OPENAI_CHANNEL_1_BASE_URL: 'https://primary.example.com/v1',
+            OPENAI_CHANNEL_1_API_KEYS: 'sk-primary',
+            OPENAI_CHANNEL_2_ID: 'backup',
+            OPENAI_CHANNEL_2_BASE_URL: 'https://backup.example.com/v1',
+            OPENAI_CHANNEL_2_API_KEYS: 'sk-backup',
+            OPENAI_CHANNEL_2_PROXY_URL: 'http://channel-proxy.example:8080'
+        });
+
+        assert.deepEqual(
+            config.credentials.map((credential) => ({
+                id: credential.id,
+                upstreamProxyUrl: credential.upstreamProxyUrl
+            })),
+            [
+                { id: 'primary#0', upstreamProxyUrl: 'https://global-proxy.example:8443/' },
+                { id: 'backup#0', upstreamProxyUrl: 'http://channel-proxy.example:8080/' }
+            ]
+        );
+        const summary = getChannelPoolSummary(config);
+        assert.deepEqual(
+            summary.channels.map((channel) => ({ id: channel.id, upstreamProxy: channel.upstreamProxy })),
+            [
+                { id: 'primary', upstreamProxy: { configured: true, protocol: 'https' } },
+                { id: 'backup', upstreamProxy: { configured: true, protocol: 'http' } }
+            ]
+        );
+        assert.equal(JSON.stringify(summary).includes('global-proxy.example'), false);
+        assert.equal(JSON.stringify(summary).includes('channel-proxy.example'), false);
+    });
+
+    it('rejects an invalid global or channel proxy URL explicitly', () => {
+        assert.throws(
+            () =>
+                parseChannelPoolConfig({
+                    OPENAI_API_KEY: 'sk-legacy',
+                    OPENAI_API_BASE_URL: 'https://legacy.example.com/v1',
+                    OPENAI_UPSTREAM_PROXY_URL: 'ftp://proxy.example'
+                }),
+            /OPENAI_UPSTREAM_PROXY_URL/
+        );
+        assert.throws(
+            () =>
+                parseChannelPoolConfig({
+                    OPENAI_CHANNEL_1_BASE_URL: 'https://primary.example.com/v1',
+                    OPENAI_CHANNEL_1_API_KEYS: 'sk-primary',
+                    OPENAI_CHANNEL_1_PROXY_URL: 'http://proxy.example/path'
+                }),
+            /OPENAI_CHANNEL_1_PROXY_URL/
+        );
+    });
+
     it('rejects invalid legacy upstream profile values instead of silently using the default profile', () => {
         assert.throws(
             () =>
@@ -236,6 +291,7 @@ describe('getChannelPoolSummary', () => {
                 {
                     id: 'official',
                     baseUrl: 'https://api.openai.com/v1',
+                    upstreamProxy: { configured: false },
                     upstreamProfile: 'openai-compatible',
                     effectiveProfile: IMAGE_UPSTREAM_PROFILES['openai-compatible'],
                     hasExtraHeaders: false,
@@ -247,6 +303,7 @@ describe('getChannelPoolSummary', () => {
                 {
                     id: 'backup',
                     baseUrl: 'https://backup.example.com/v1',
+                    upstreamProxy: { configured: false },
                     upstreamProfile: 'openai-compatible',
                     effectiveProfile: IMAGE_UPSTREAM_PROFILES['openai-compatible'],
                     hasExtraHeaders: false,
@@ -277,6 +334,7 @@ describe('getChannelPoolSummary', () => {
                 {
                     id: 'matsca',
                     baseUrl: 'https://matsca.example.com/v1',
+                    upstreamProxy: { configured: false },
                     upstreamProfile: 'matsca',
                     effectiveProfile: IMAGE_UPSTREAM_PROFILES.matsca,
                     hasExtraHeaders: true,
@@ -390,6 +448,7 @@ describe('getChannelPoolSummary', () => {
                 {
                     id: 'custom',
                     baseUrl: 'https://custom.example.com/v1',
+                    upstreamProxy: { configured: false },
                     upstreamProfile: 'matsca',
                     effectiveProfile: config.credentials[0]?.providerProfile,
                     hasExtraHeaders: false,
@@ -1681,6 +1740,7 @@ describe('resolveEffectiveCredential', () => {
             requestApiKey: 'sk-browser',
             requestApiBaseUrl: '',
             legacyBaseUrl: 'https://legacy.example.com/v1',
+            legacyUpstreamProxyUrl: 'http://proxy.example:8080/',
             selectedCredential: {
                 id: 'server#0',
                 channelId: 'server',
@@ -1693,6 +1753,7 @@ describe('resolveEffectiveCredential', () => {
         assert.deepEqual(credential, {
             apiKey: 'sk-browser',
             baseUrl: 'https://legacy.example.com/v1',
+            upstreamProxyUrl: 'http://proxy.example:8080/',
             upstreamProfile: 'openai-compatible'
         });
     });

src/lib/channel-router.ts

@@ -29,6 +29,11 @@ import {
     type ImageProviderManifest,
     type ImageProviderManifestSummary
 } from './image-upstream-provider-manifest';
+import {
+    readOpenAIUpstreamProxyUrl,
+    summarizeOpenAIUpstreamProxy,
+    type UpstreamProxySummary
+} from './openai-image-transport';
 
 export type RoutingStrategy = 'sticky' | 'round_robin' | 'random';
 
@@ -37,6 +42,7 @@ export type ChannelCredential = {
     channelId: string;
     apiKey: string;
     baseUrl?: string;
+    upstreamProxyUrl?: string;
     upstreamProfile: ImageUpstreamProfileId;
     upstreamHeaders?: UpstreamRequestHeaders;
     providerManifest?: ImageProviderManifestSummary;
@@ -61,6 +67,7 @@ export type ChannelPoolSummary = {
     channels: Array<{
         id: string;
         baseUrl?: string;
+        upstreamProxy: UpstreamProxySummary;
         upstreamProfile: ImageUpstreamProfileId;
         effectiveProfile: ImageUpstreamProfile;
         hasExtraHeaders: boolean;
@@ -167,6 +174,7 @@ export type ChannelHealthSnapshot = {
     at: number;
     channels: Array<{
         channelId: string;
+        upstreamProxy: UpstreamProxySummary;
         credentialCount: number;
         healthyCredentialCount: number;
         unhealthyCredentialCount: number;
@@ -186,6 +194,7 @@ export type ChannelRecoveryProbeCandidate = {
 export type EffectiveCredential = {
     apiKey?: string;
     baseUrl?: string;
+    upstreamProxyUrl?: string;
     upstreamProfile: ImageUpstreamProfileId;
     providerProfile?: ImageUpstreamProfile;
     upstreamHeaders?: UpstreamRequestHeaders;
@@ -204,7 +213,7 @@ const DEFAULT_STRATEGY: RoutingStrategy = 'sticky';
 const DEFAULT_FAILURE_COOLDOWN_MS = 30_000;
 const VALID_STRATEGIES = new Set<RoutingStrategy>(['sticky', 'round_robin', 'random']);
 const CHANNEL_KEY_PATTERN =
-    /^OPENAI_CHANNEL_(\d+)_(ID|BASE_URL|API_KEYS|UPSTREAM_PROFILE|PROVIDER_MANIFEST|REQUEST_MODES|REQUEST_MODE_PRIORITY|MATSCA_APP_ID|MATSCA_APP_SECRET|USER_AGENT|UPSTREAM_HEADERS_JSON|FAILURE_COOLDOWN_MS)$/;
+    /^OPENAI_CHANNEL_(\d+)_(ID|BASE_URL|API_KEYS|UPSTREAM_PROFILE|PROVIDER_MANIFEST|REQUEST_MODES|REQUEST_MODE_PRIORITY|MATSCA_APP_ID|MATSCA_APP_SECRET|USER_AGENT|UPSTREAM_HEADERS_JSON|FAILURE_COOLDOWN_MS|PROXY_URL)$/;
 
 export function parseChannelPoolConfig(env: Record<string, string | undefined>): ChannelPoolConfig {
     if (env.OPENAI_CHANNELS_JSON?.trim()) {
@@ -214,9 +223,10 @@ export function parseChannelPoolConfig(env: Record<string, string | undefined>):
         );
     }
 
+    const globalUpstreamProxyUrl = readOpenAIUpstreamProxyUrl(env);
     const channelIndexes = readConfiguredChannelIndexes(env);
     if (channelIndexes.length === 0) {
-        return parseLegacyConfig(env);
+        return parseLegacyConfig(env, globalUpstreamProxyUrl);
     }
 
     const strategy = readStrategy(env.OPENAI_ROUTING_STRATEGY, 'OPENAI_ROUTING_STRATEGY');
@@ -225,7 +235,7 @@ export function parseChannelPoolConfig(env: Record<string, string | undefined>):
         'OPENAI_UPSTREAM_REQUEST_MODE_PRIORITY'
     );
     const credentials = channelIndexes.flatMap((channelIndex) =>
-        parseNumberedChannel(env, channelIndex, requestModePriority)
+        parseNumberedChannel(env, channelIndex, requestModePriority, globalUpstreamProxyUrl)
     );
 
     if (credentials.length === 0) {
@@ -769,6 +779,7 @@ export function createChannelRouter(options: ChannelRouterOptions): ChannelRoute
                     const healthyCredentialCount = credentials.filter((credential) => credential.state === 'healthy').length;
                     return {
                         channelId,
+                        upstreamProxy: summarizeOpenAIUpstreamProxy(channelCredentials[0]?.upstreamProxyUrl),
                         credentialCount: credentials.length,
                         healthyCredentialCount,
                         unhealthyCredentialCount: credentials.length - healthyCredentialCount,
@@ -985,6 +996,7 @@ export function getChannelPoolSummary(config: ChannelPoolConfig): ChannelPoolSum
         {
             id: string;
             baseUrl?: string;
+            upstreamProxy: UpstreamProxySummary;
             upstreamProfile: ImageUpstreamProfileId;
             effectiveProfile: ImageUpstreamProfile;
             hasExtraHeaders: boolean;
@@ -1005,6 +1017,7 @@ export function getChannelPoolSummary(config: ChannelPoolConfig): ChannelPoolSum
         channels.set(credential.channelId, {
             id: credential.channelId,
             baseUrl: credential.baseUrl,
+            upstreamProxy: summarizeOpenAIUpstreamProxy(credential.upstreamProxyUrl),
             upstreamProfile: credential.upstreamProfile,
             effectiveProfile: credential.providerProfile || IMAGE_UPSTREAM_PROFILES[credential.upstreamProfile],
             hasExtraHeaders: Boolean(credential.upstreamHeaders),
@@ -1085,6 +1098,7 @@ export function resolveEffectiveCredential(options: {
     requestApiKey: string;
     requestApiBaseUrl: string;
     legacyBaseUrl?: string;
+    legacyUpstreamProxyUrl?: string;
     selectedCredential?: ChannelCredential;
 }): EffectiveCredential {
     if (options.requestApiKey) {
@@ -1094,6 +1108,7 @@ export function resolveEffectiveCredential(options: {
         return {
             apiKey: options.requestApiKey,
             baseUrl: options.requestApiBaseUrl || normalizeOptionalString(options.legacyBaseUrl),
+            ...(options.legacyUpstreamProxyUrl ? { upstreamProxyUrl: options.legacyUpstreamProxyUrl } : {}),
             upstreamProfile: requestProfile.id
         };
     }
@@ -1101,6 +1116,9 @@ export function resolveEffectiveCredential(options: {
     return {
         apiKey: options.selectedCredential?.apiKey,
         baseUrl: options.selectedCredential?.baseUrl,
+        ...(options.selectedCredential?.upstreamProxyUrl
+            ? { upstreamProxyUrl: options.selectedCredential.upstreamProxyUrl }
+            : {}),
         upstreamProfile: options.selectedCredential?.upstreamProfile || DEFAULT_EFFECTIVE_PROFILE_ID,
         ...(options.selectedCredential?.providerProfile
             ? { providerProfile: options.selectedCredential.providerProfile }
@@ -1194,7 +1212,10 @@ export function toPublicChannelFailure(
     };
 }
 
-function parseLegacyConfig(env: Record<string, string | undefined>): ChannelPoolConfig {
+function parseLegacyConfig(
+    env: Record<string, string | undefined>,
+    globalUpstreamProxyUrl: string | undefined
+): ChannelPoolConfig {
     const apiKey = env.OPENAI_API_KEY?.trim();
     const baseUrl = normalizeOptionalString(env.OPENAI_API_BASE_URL);
 
@@ -1227,6 +1248,7 @@ function parseLegacyConfig(env: Record<string, string | undefined>): ChannelPool
                 channelId: 'default',
                 apiKey,
                 baseUrl,
+                ...(globalUpstreamProxyUrl ? { upstreamProxyUrl: globalUpstreamProxyUrl } : {}),
                 upstreamProfile: readImageUpstreamProfile({
                     explicitProfile: rawProfile,
                     channelId: 'default',
@@ -1242,11 +1264,14 @@ function parseLegacyConfig(env: Record<string, string | undefined>): ChannelPool
 function parseNumberedChannel(
     env: Record<string, string | undefined>,
     channelIndex: number,
-    globalRequestModePriority?: ChannelRequestMode[]
+    globalRequestModePriority?: ChannelRequestMode[],
+    globalUpstreamProxyUrl?: string
 ): ChannelCredential[] {
     const channelId = readOptionalEnv(env, `OPENAI_CHANNEL_${channelIndex}_ID`) || `channel-${channelIndex}`;
     const rawApiKeys = readRequiredEnv(env, `OPENAI_CHANNEL_${channelIndex}_API_KEYS`);
     const baseUrl = normalizeOptionalString(env[`OPENAI_CHANNEL_${channelIndex}_BASE_URL`]);
+    const upstreamProxyUrl =
+        readOpenAIUpstreamProxyUrl(env, `OPENAI_CHANNEL_${channelIndex}_PROXY_URL`) ?? globalUpstreamProxyUrl;
     const upstreamProfile = readChannelProfile(env, channelIndex, channelId, baseUrl);
     const upstreamHeaders = readChannelUpstreamHeaders(env, channelIndex, upstreamProfile);
     const providerManifest = readChannelProviderManifest(env, channelIndex, upstreamProfile);
@@ -1285,6 +1310,7 @@ function parseNumberedChannel(
         channelId,
         apiKey,
         baseUrl,
+        ...(upstreamProxyUrl ? { upstreamProxyUrl } : {}),
         upstreamProfile,
         ...(upstreamHeaders ? { upstreamHeaders } : {}),
         ...(providerManifest ? { providerManifest: createProviderManifestSummary(providerManifest) } : {}),

src/lib/image-route-mode-handlers.ts

@@ -62,6 +62,7 @@ type CommonModeInput = {
     storageMode: StorageMode;
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     startedAtMs: number;
     upstreamIdempotencyKey?: string;
     clientRequestId?: string;
@@ -330,6 +331,7 @@ async function createResponsesImageStreamResponse(
         storageMode: input.storageMode,
         apiBaseUrl: input.apiBaseUrl,
         apiKey: input.apiKey,
+        upstreamProxyUrl: input.upstreamProxyUrl,
         upstreamHeaders: input.upstreamHeaders,
         model: input.model,
         startedAtMs: input.startedAtMs,
@@ -372,6 +374,7 @@ async function createGenerateStreamResponse(
         stream = await createImagesApiGenerateStream({
             apiBaseUrl: input.apiBaseUrl,
             apiKey: input.apiKey,
+            upstreamProxyUrl: input.upstreamProxyUrl,
             upstreamHeaders: input.upstreamHeaders,
             idempotencyKey: input.upstreamIdempotencyKey,
             abortSignal: input.abortSignal,
@@ -389,6 +392,7 @@ async function createGenerateStreamResponse(
         storageMode: input.storageMode,
         apiBaseUrl: input.apiBaseUrl,
         apiKey: input.apiKey,
+        upstreamProxyUrl: input.upstreamProxyUrl,
         upstreamHeaders: input.upstreamHeaders,
         model: input.model,
         startedAtMs: input.startedAtMs,
@@ -532,6 +536,7 @@ async function createEditStreamResponse(input: CommonModeInput, options: EditOpt
         storageMode: input.storageMode,
         apiBaseUrl: input.apiBaseUrl,
         apiKey: input.apiKey,
+        upstreamProxyUrl: input.upstreamProxyUrl,
         upstreamHeaders: input.upstreamHeaders,
         model: input.model,
         startedAtMs: input.startedAtMs,
@@ -596,6 +601,7 @@ export async function handleEditImageMode(
                 storageMode: input.storageMode,
                 apiBaseUrl: input.apiBaseUrl,
                 apiKey: input.apiKey,
+                upstreamProxyUrl: input.upstreamProxyUrl,
                 upstreamHeaders: input.upstreamHeaders,
                 model: input.model,
                 startedAtMs: input.startedAtMs,

src/lib/image-route-support.ts

@@ -437,6 +437,7 @@ export async function ensureOutputDirExists() {
 async function resolveRequestActualCost(input: {
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     model: string;
     startedAtMs: number;
     expectedImageCount: number;
@@ -453,6 +454,7 @@ async function resolveRequestActualCost(input: {
     return resolveActualCost({
         apiBaseUrl: input.apiBaseUrl,
         apiKey: input.apiKey,
+        ...(input.upstreamProxyUrl ? { upstreamProxyUrl: input.upstreamProxyUrl } : {}),
         model: input.model,
         startedAtMs: input.startedAtMs,
         finishedAtMs,
@@ -463,6 +465,7 @@ async function resolveRequestActualCost(input: {
 export async function resolveRequestActualCostSafely(input: {
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     model: string;
     startedAtMs: number;
     expectedImageCount: number;

src/lib/image-service.ts

@@ -170,6 +170,7 @@ export async function persistOpenAiImages(options: {
     batchId?: string;
     apiBaseUrl?: string;
     apiKey?: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     abortSignal?: AbortSignal;
 }): Promise<PersistedOpenAiImage[]> {
@@ -191,6 +192,7 @@ export async function persistOpenAiImages(options: {
                       imageUrl: imageData.url,
                       apiBaseUrl: options.apiBaseUrl,
                       apiKey: options.apiKey,
+                      upstreamProxyUrl: options.upstreamProxyUrl,
                       upstreamHeaders: options.upstreamHeaders,
                       abortSignal: options.abortSignal
                   })

src/lib/image-stream-collector.ts

@@ -39,6 +39,7 @@ export async function collectOpenAiImagesFromStream(
     options: {
         apiBaseUrl?: string;
         apiKey?: string;
+        upstreamProxyUrl?: string;
         upstreamHeaders?: UpstreamRequestHeaders;
         abortSignal?: AbortSignal;
         onStreamingDegraded?: (reason: string) => void;
@@ -83,6 +84,7 @@ export async function collectOpenAiImagesFromStream(
                               imageUrl: normalizedEvent.imageUrl,
                               apiBaseUrl: options.apiBaseUrl,
                               apiKey: options.apiKey,
+                              upstreamProxyUrl: options.upstreamProxyUrl,
                               upstreamHeaders: options.upstreamHeaders,
                               abortSignal: options.abortSignal
                           })

src/lib/image-stream-service.ts

@@ -49,6 +49,7 @@ type SseWriter = ReturnType<typeof createSseWriter>;
 type ResolveStreamCostInput = {
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     model: string;
     startedAtMs: number;
@@ -63,6 +64,7 @@ export type ImageStreamResponseOptions = {
     storageMode: StorageMode;
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     model: string;
     startedAtMs: number;
@@ -218,6 +220,7 @@ async function downloadOptionalPartialImage(runtime: StreamRuntime, imageUrl: st
             imageUrl,
             apiBaseUrl: runtime.options.apiBaseUrl,
             apiKey: runtime.options.apiKey,
+            upstreamProxyUrl: runtime.options.upstreamProxyUrl,
             upstreamHeaders: runtime.options.upstreamHeaders,
             abortSignal: runtime.options.abortSignal
         });
@@ -257,6 +260,7 @@ async function emitCompletedImage(
                   imageUrl: normalizedEvent.imageUrl,
                   apiBaseUrl: runtime.options.apiBaseUrl,
                   apiKey: runtime.options.apiKey,
+                  upstreamProxyUrl: runtime.options.upstreamProxyUrl,
                   upstreamHeaders: runtime.options.upstreamHeaders,
                   abortSignal: runtime.options.abortSignal
               })
@@ -368,6 +372,7 @@ async function emitFallbackImages(runtime: StreamRuntime, result: OpenAI.Images.
                       imageUrl: image.url,
                       apiBaseUrl: runtime.options.apiBaseUrl,
                       apiKey: runtime.options.apiKey,
+                      upstreamProxyUrl: runtime.options.upstreamProxyUrl,
                       upstreamHeaders: runtime.options.upstreamHeaders,
                       abortSignal: runtime.options.abortSignal
                   })
@@ -396,6 +401,7 @@ async function emitDoneEvent(runtime: StreamRuntime): Promise<boolean> {
     const actualCost = await runtime.options.resolveActualCost({
         apiBaseUrl: runtime.options.apiBaseUrl,
         apiKey: runtime.options.apiKey,
+        upstreamProxyUrl: runtime.options.upstreamProxyUrl,
         model: runtime.options.model,
         startedAtMs: runtime.options.startedAtMs,
         expectedImageCount: runtime.state.completedImages.length,

src/lib/image-url-result.test.ts

@@ -44,6 +44,35 @@ describe('downloadSameOriginImageAsBase64', () => {
         assert.equal(observedAppSecret, 'app-secret');
     });
 
+    it('uses the shared header policy when the image download has no API key', async () => {
+        let observedProxyAuthorization: string | null = null;
+        let observedUserAgent: string | null = null;
+        let observedAppId: string | null = null;
+        globalThis.fetch = async (_url, init) => {
+            const headers = new Headers(init?.headers);
+            observedProxyAuthorization = headers.get('proxy-authorization');
+            observedUserAgent = headers.get('user-agent');
+            observedAppId = headers.get('x-app-id');
+            return new Response(Buffer.from('png'), {
+                status: 200,
+                headers: { 'content-type': 'image/png' }
+            });
+        };
+
+        await downloadSameOriginImageAsBase64({
+            imageUrl: '/generated/final.png',
+            apiBaseUrl: 'https://api.example.test/v1',
+            upstreamHeaders: {
+                'Proxy-Authorization': 'Basic c2VjcmV0',
+                'X-App-ID': 'app-id'
+            }
+        });
+
+        assert.equal(observedProxyAuthorization, null);
+        assert.equal(observedUserAgent, 'gpt-image-playground/2.1.0');
+        assert.equal(observedAppId, 'app-id');
+    });
+
     it('enforces the remote image size limit when fetch returns no stream body', async () => {
         let arrayBufferRead = false;
         globalThis.fetch = async () =>

src/lib/image-url-result.ts

@@ -1,5 +1,6 @@
 import { RequestValidationError } from './image-request-utils';
 import { mergeUpstreamHeadersWithFixed, type UpstreamRequestHeaders } from './image-upstream-profile';
+import { fetchOpenAIUpstream } from './openai-image-transport';
 
 const MAX_REMOTE_IMAGE_BYTES = 25 * 1024 * 1024;
 const REMOTE_IMAGE_DOWNLOAD_TIMEOUT_MS = 30000;
@@ -41,6 +42,7 @@ export async function downloadSameOriginImageAsBase64(input: {
     imageUrl: string;
     apiBaseUrl?: string;
     apiKey?: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     abortSignal?: AbortSignal;
 }): Promise<string> {
@@ -50,10 +52,14 @@ export async function downloadSameOriginImageAsBase64(input: {
     const abortListener = () => controller.abort();
     input.abortSignal?.addEventListener('abort', abortListener, { once: true });
     try {
-        const response = await fetch(url, {
-            headers: buildDownloadHeaders(input.apiKey, input.upstreamHeaders),
-            signal: controller.signal
-        });
+        const response = await fetchOpenAIUpstream(
+            url,
+            {
+                headers: buildDownloadHeaders(input.apiKey, input.upstreamHeaders),
+                signal: controller.signal
+            },
+            input.upstreamProxyUrl
+        );
         if (!response.ok) {
             throw new RemoteImageResultError(`下载上游图片失败：HTTP ${response.status}。`);
         }
@@ -86,9 +92,10 @@ function buildDownloadHeaders(
     apiKey: string | undefined,
     upstreamHeaders: UpstreamRequestHeaders | undefined
 ): UpstreamRequestHeaders | undefined {
-    const headers = apiKey
-        ? mergeUpstreamHeadersWithFixed(upstreamHeaders, { Authorization: `Bearer ${apiKey}` })
-        : { ...(upstreamHeaders || {}) };
+    const headers = mergeUpstreamHeadersWithFixed(
+        upstreamHeaders,
+        apiKey ? { Authorization: `Bearer ${apiKey}` } : {}
+    );
     return Object.keys(headers).length > 0 ? headers : undefined;
 }
 

src/lib/images-api-stream.ts

@@ -1,5 +1,5 @@
 import { mergeUpstreamHeadersWithFixed, type UpstreamRequestHeaders } from './image-upstream-profile';
-import { readImageUpstreamTimeoutMs } from './openai-image-transport';
+import { fetchOpenAIUpstream, readImageUpstreamTimeoutMs } from './openai-image-transport';
 import type OpenAI from 'openai';
 
 export class ImagesApiStreamError extends Error {
@@ -15,6 +15,7 @@ export class ImagesApiStreamError extends Error {
 type ImagesApiStreamInput = {
     apiBaseUrl?: string;
     apiKey: string;
+    upstreamProxyUrl?: string;
     upstreamHeaders?: UpstreamRequestHeaders;
     idempotencyKey?: string;
     abortSignal?: AbortSignal;
@@ -133,21 +134,25 @@ function readSseChunk(chunk: string): unknown | undefined {
 }
 
 export async function createImagesApiGenerateStream(input: ImagesApiStreamInput): Promise<AsyncIterable<unknown>> {
-    const { abortSignal, apiBaseUrl, apiKey, idempotencyKey, params, upstreamHeaders } = input;
+    const { abortSignal, apiBaseUrl, apiKey, idempotencyKey, params, upstreamHeaders, upstreamProxyUrl } = input;
     const abortContext = createAbortContext({ abortSignal, timeoutMs: input.timeoutMs });
     let response: Response;
     try {
-        response = await fetch(buildImagesGenerateUrl(apiBaseUrl), {
-            method: 'POST',
-            headers: mergeUpstreamHeadersWithFixed(upstreamHeaders, {
-                Authorization: `Bearer ${apiKey}`,
-                'Content-Type': 'application/json',
-                Accept: 'text/event-stream, application/json',
-                ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {})
-            }),
-            signal: abortContext.signal,
-            body: JSON.stringify(params)
-        });
+        response = await fetchOpenAIUpstream(
+            buildImagesGenerateUrl(apiBaseUrl),
+            {
+                method: 'POST',
+                headers: mergeUpstreamHeadersWithFixed(upstreamHeaders, {
+                    Authorization: `Bearer ${apiKey}`,
+                    'Content-Type': 'application/json',
+                    Accept: 'text/event-stream, application/json',
+                    ...(idempotencyKey ? { 'Idempotency-Key': idempotencyKey } : {})
+                }),
+                signal: abortContext.signal,
+                body: JSON.stringify(params)
+            },
+            upstreamProxyUrl
+        );
     } catch (error) {
         abortContext.cleanup();
         throw error;