fix(model): 保持账户路由逻辑调用在重试中的幂等身份

crates/tui/src/client/anthropic.rs

@@ -279,8 +279,7 @@ impl DeepSeekClient {
         // non-streaming completion; without it a provider that accepts and
         // stalls - or trickles the body - wedged the caller indefinitely.
         let response = self
-            .http_client
-            .post(&url)
+            .with_operation_header(self.http_client.post(&url))
             .header("Accept", "text/event-stream")
             .timeout(crate::client::non_streaming_request_envelope())
             .json(body)
@@ -364,8 +363,7 @@ impl DeepSeekClient {
                     self.http1_fallback_client(),
                     policy,
                 );
-                client
-                    .post(&url)
+                self.with_operation_header(client.post(&url))
                     .header("Accept", "text/event-stream")
                     .json(body)
                     .send()

crates/tui/src/client/chat.rs

@@ -1356,8 +1356,8 @@ impl DeepSeekClient {
                         self.http1_fallback_client(),
                         policy,
                     );
-                    Ok(client
-                        .post(url)
+                    Ok(self
+                        .with_operation_header(client.post(url))
                         .header(reqwest::header::CONTENT_TYPE, "application/json")
                         .json(body)
                         .send()

crates/tui/src/client/provider_native_search.rs

@@ -172,11 +172,11 @@ impl ProviderNativeSearchClient {
         };
         let body_bytes = serde_json::to_vec(&body)
             .context("failed to serialize provider-native web-search request")?;
-        let response = self
-            .inner
+        let call = self.inner.for_operation(uuid::Uuid::new_v4());
+        let response = call
             .send_with_retry(|| {
-                self.inner
-                    .http_client
+                // The shared retry transport attaches the frozen key once.
+                call.http_client
                     .post(&url)
                     .header("Accept", "application/json")
                     .body(body_bytes.clone())
@@ -211,8 +211,8 @@ impl ProviderNativeSearchClient {
         let body_bytes = serde_json::to_vec(&body)
             .context("failed to serialize provider-native web-search request")?;
         let headers = headers.to_vec();
-        let response = self
-            .inner
+        let call = self.inner.for_operation(uuid::Uuid::new_v4());
+        let response = call
             .send_with_retry(|| {
                 let mut request = self
                     .inner
@@ -234,11 +234,14 @@ impl ProviderNativeSearchClient {
     }
 
     pub(super) async fn get_json(&self, url: &str) -> Result<Value> {
-        let response = self
-            .inner
+        // Polling is not another inference dispatch. A search adapter can be
+        // constructed from a request-local client, so explicitly drop any
+        // inherited logical operation rather than relying on its caller.
+        let mut call = self.inner.clone();
+        call.operation_id = None;
+        let response = call
             .send_with_retry(|| {
-                self.inner
-                    .http_client
+                call.http_client
                     .get(url)
                     .header("Accept", "application/json")
             })
@@ -251,6 +254,80 @@ impl ProviderNativeSearchClient {
     }
 }
 
+#[cfg(test)]
+mod operation_receipts {
+    use super::*;
+    use crate::config::Config;
+    use wiremock::matchers::method;
+    use wiremock::{Mock, MockServer, ResponseTemplate};
+
+    #[tokio::test]
+    async fn forkguard_model_operation_search_rounds_and_polling() {
+        let server = MockServer::start().await;
+        let attempts = std::sync::Arc::new(std::sync::atomic::AtomicUsize::new(0));
+        Mock::given(method("POST"))
+            .respond_with(move |_: &wiremock::Request| {
+                if attempts.fetch_add(1, std::sync::atomic::Ordering::SeqCst) == 0 {
+                    ResponseTemplate::new(503)
+                } else {
+                    ResponseTemplate::new(200).set_body_json(json!({"status":"ok"}))
+                }
+            })
+            .mount(&server)
+            .await;
+        Mock::given(method("GET"))
+            .respond_with(ResponseTemplate::new(200).set_body_json(json!({"status":"done"})))
+            .mount(&server)
+            .await;
+        let mut inner = DeepSeekClient::new(&Config {
+            provider: Some("deepseek".into()),
+            api_key: Some("owned-test-key".into()),
+            base_url: Some(server.uri()),
+            default_text_model: Some("deepseek-v4-pro".into()),
+            request_idempotency_header: Some("idempotency-key".into()),
+            ..Default::default()
+        })
+        .unwrap();
+        inner.retry.enabled = true;
+        inner.retry.max_retries = 1;
+        inner.retry.initial_delay = 0.001;
+        inner.retry.max_delay = 0.001;
+        inner.isolated_request_state = true;
+        let parent = uuid::Uuid::new_v4();
+        inner.operation_id = Some(parent);
+        let search = ProviderNativeSearchClient::new(inner).unwrap();
+        let url = format!("{}/owned-round", server.uri());
+        for round in [1, 2] {
+            search
+                .post_json(&url, &json!({"round":round}), &[])
+                .await
+                .unwrap();
+        }
+        search.get_json(&url).await.unwrap();
+        assert_eq!(search.inner.operation_id, Some(parent));
+        let receipts = server.received_requests().await.unwrap();
+        assert_eq!(receipts.len(), 4);
+        assert_eq!(receipts[0].body, receipts[1].body);
+        assert_ne!(receipts[1].body, receipts[2].body);
+        let id = |index: usize| {
+            receipts[index]
+                .headers
+                .get("idempotency-key")
+                .unwrap()
+                .to_str()
+                .unwrap()
+        };
+        for receipt in &receipts[..3] {
+            assert_eq!(receipt.headers.get_all("idempotency-key").iter().count(), 1);
+        }
+        assert_eq!(id(0), id(1));
+        assert_ne!(id(1), id(2));
+        assert_ne!(id(0), parent.to_string());
+        assert_eq!(receipts[3].method, "GET");
+        assert!(!receipts[3].headers.contains_key("idempotency-key"));
+    }
+}
+
 #[derive(Clone, Copy)]
 enum ResponsesSearchDialect {
     Openai,

crates/tui/src/compaction.rs

@@ -1197,6 +1197,10 @@ pub async fn compact_messages_safe(
 
     let mut last_error: Option<anyhow::Error> = None;
     let mut quality_retries = 0u32;
+    // The outer transient retry owns the logical call. Changed quality or
+    // overflow requests must get a new ID even if a later retry rebuilds the
+    // original request again.
+    let mut summary_operation = None;
 
     for attempt in 0..MAX_RETRIES {
         if attempt > 0 {
@@ -1205,8 +1209,14 @@ pub async fn compact_messages_safe(
             tokio::time::sleep(delay).await;
         }
 
-        match compact_messages_with_metadata(client, compaction_input, config, &mut quality_retries)
-            .await
+        match compact_messages_with_metadata(
+            client,
+            compaction_input,
+            config,
+            &mut quality_retries,
+            &mut summary_operation,
+        )
+        .await
         {
             Ok((msgs, prompt, mut coverage)) => {
                 let kept = sanitize_retained_messages(msgs);
@@ -1310,7 +1320,8 @@ async fn compact_messages(
 ) -> Result<(Vec<Message>, Option<SystemPrompt>, Vec<Message>)> {
     let mut quality_retries = 0;
     let (messages, summary_prompt, _coverage) =
-        compact_messages_with_metadata(client, messages, config, &mut quality_retries).await?;
+        compact_messages_with_metadata(client, messages, config, &mut quality_retries, &mut None)
+            .await?;
     Ok((messages, summary_prompt, Vec::new()))
 }
 
@@ -1319,12 +1330,14 @@ async fn compact_messages_with_metadata(
     messages: &[Message],
     config: &CompactionConfig,
     quality_retries: &mut u32,
+    summary_operation: &mut Option<(String, uuid::Uuid)>,
 ) -> Result<(Vec<Message>, Option<SystemPrompt>, CompactionCoverage)> {
     if messages.is_empty() {
         return Ok((Vec::new(), None, CompactionCoverage::default()));
     }
 
-    let summary = create_summary(client, messages, config, quality_retries).await?;
+    let summary =
+        create_summary(client, messages, config, quality_retries, summary_operation).await?;
     let anchors = user_anchors_section(config.workspace.as_deref());
     let checkpoint_text = build_compaction_summary_block_text(&summary, &anchors);
     let summary_block = SystemBlock {
@@ -1441,6 +1454,7 @@ async fn create_summary(
     messages: &[Message],
     config: &CompactionConfig,
     quality_retries: &mut u32,
+    summary_operation: &mut Option<(String, uuid::Uuid)>,
 ) -> Result<String> {
     // The summarization request IS the live conversation plus one final user
     // message asking for the handoff summary, so the provider's prefix cache
@@ -1495,7 +1509,19 @@ async fn create_summary(
         // Capture the session scope before awaiting so a late response cannot
         // accrue into a subsequently loaded/new session.
         let cost_scope = crate::cost_status::scope_token();
-        let response = match client.create_message(request).await {
+        // This fixed client route sends a deterministic non-streaming request
+        // without caller-local metadata. Compare the complete request so a
+        // shortened history or conservative prompt cannot reuse an old key.
+        let identity = crate::hashing::sha256_hex(&serde_json::to_vec(&request)?);
+        let operation_id = match summary_operation.as_ref() {
+            Some((previous, id)) if previous == &identity => *id,
+            _ => uuid::Uuid::new_v4(),
+        };
+        *summary_operation = Some((identity, operation_id));
+        let response = match client
+            .create_message_for_operation(request, operation_id)
+            .await
+        {
             Ok(response) => response,
             Err(err) if is_context_window_error(&err) && request_messages.len() > 2 => {
                 logging::warn(format!(
@@ -1930,6 +1956,7 @@ mod tests {
     struct ScriptedSummaryClient {
         responses: std::sync::Mutex<std::collections::VecDeque<anyhow::Result<Vec<ContentBlock>>>>,
         requests: std::sync::Mutex<Vec<MessageRequest>>,
+        operations: std::sync::Mutex<Vec<uuid::Uuid>>,
     }
 
     impl ScriptedSummaryClient {
@@ -1941,6 +1968,7 @@ mod tests {
             Self {
                 responses: std::sync::Mutex::new(responses.into()),
                 requests: std::sync::Mutex::new(Vec::new()),
+                operations: std::sync::Mutex::new(Vec::new()),
             }
         }
     }
@@ -1983,6 +2011,15 @@ mod tests {
             })
         }
 
+        async fn create_message_for_operation(
+            &self,
+            request: MessageRequest,
+            operation_id: uuid::Uuid,
+        ) -> anyhow::Result<crate::models::MessageResponse> {
+            self.operations.lock().unwrap().push(operation_id);
+            self.create_message(request).await
+        }
+
         async fn create_message_stream(
             &self,
             _request: MessageRequest,
@@ -2383,6 +2420,12 @@ mod tests {
         };
         assert!(text.contains("previous handoff response was empty"));
         drop(requests);
+        let operations = client.operations.lock().unwrap();
+        assert_eq!(operations.len(), 2);
+        assert_ne!(
+            operations[0], operations[1],
+            "quality retry changes the prompt"
+        );
 
         assert_eq!(
             result.retries_used, 1,
@@ -2438,6 +2481,57 @@ mod tests {
             3,
             "the diagnostic count must match the two calls after the initial request"
         );
+        let requests = client.requests.lock().unwrap();
+        assert_eq!(
+            serde_json::to_vec(&requests[0]).unwrap(),
+            serde_json::to_vec(&requests[2]).unwrap()
+        );
+        assert_ne!(
+            serde_json::to_vec(&requests[0]).unwrap(),
+            serde_json::to_vec(&requests[1]).unwrap()
+        );
+        let operations = client.operations.lock().unwrap();
+        assert_eq!(operations.len(), 3);
+        assert_ne!(operations[0], operations[1]);
+        assert_ne!(operations[1], operations[2]);
+        assert_ne!(
+            operations[0], operations[2],
+            "rebuilding the original prompt after a changed call must not resurrect its ID"
+        );
+    }
+
+    #[tokio::test]
+    async fn forkguard_model_operation_compaction_overflow_changes_id() {
+        let client = ScriptedSummaryClient::with_outcomes(vec![
+            Err(anyhow::anyhow!("request exceeds context window")),
+            Ok(vec![ContentBlock::Text {
+                text: FIXED_SUMMARY.into(),
+                cache_control: None,
+            }]),
+        ]);
+        let config = CompactionConfig {
+            model: "test-model".into(),
+            cache_summary: false,
+            ..Default::default()
+        };
+        compact_messages_safe(
+            &client,
+            &[msg("user", "old history"), msg("assistant", "current work")],
+            None,
+            &prepared(&config),
+        )
+        .await
+        .unwrap();
+        let requests = client.requests.lock().unwrap();
+        assert_eq!(requests.len(), 2);
+        assert_eq!(requests[0].messages.len(), requests[1].messages.len() + 1);
+        assert_eq!(&requests[0].messages[1..], requests[1].messages.as_slice());
+        let operations = client.operations.lock().unwrap();
+        assert_eq!(operations.len(), 2);
+        assert_ne!(
+            operations[0], operations[1],
+            "dropping history changes the call"
+        );
     }
 
     #[tokio::test]

crates/tui/src/config.rs

@@ -2959,6 +2959,17 @@ pub struct Config {
     /// Optional extra HTTP headers sent to model API requests.
     #[serde(alias = "httpHeaders")]
     pub http_headers: Option<HashMap<String, String>>,
+    /// Host-only, route-scoped opt-in to logical model-call idempotency.
+    /// Never persisted or accepted from provider configuration files.
+    /// Network, engine, compaction, subagent and matching vision retries reuse
+    /// a key only for the same logical request. Translation, FIM, speech
+    /// synthesis and native-search POSTs each start a new call whose transport
+    /// retries share its key; successive agentic-search rounds use new keys.
+    /// Model listing does not mint logical-call keys; native-search GETs
+    /// neither mint nor inherit them. Ordinary routes retain static headers;
+    /// a static Idempotency-Key conflicts with this opt-in and is rejected.
+    #[serde(skip)]
+    pub request_idempotency_header: Option<String>,
     /// Optional user-facing tab/window title shown as `[title] …` in front of
     /// the terminal window title (the `Codewhale` / `reasoning…` / `done.`
     /// states). This is the default for every session in this config scope;
@@ -5513,6 +5524,27 @@ impl Config {
     /// otherwise capture the table. Removing it from the scoped clone keeps
     /// the root endpoint authoritative without mutating the live registry.
     pub(crate) fn scope_to_provider_identity(&mut self, identity: &ProviderIdentity) {
+        if self.request_idempotency_header.is_some()
+            && !self
+                .provider
+                .as_deref()
+                .filter(|name| !name.trim().is_empty() && ApiProvider::parse(name).is_none())
+                .map_or_else(
+                    || self.active_provider_identity(self.api_provider()),
+                    |name| self.resolve_provider_identity(name),
+                )
+                .is_ok_and(|source| source == *identity)
+        {
+            crate::logging::warn(
+                "Clearing host-only request idempotency: the source provider identity is unresolved or differs from the scoped route",
+            );
+            self.request_idempotency_header = None;
+        }
+        if identity.migrated_legacy_ollama_cloud_route {
+            crate::logging::warn(
+                "Scoping a legacy Ollama cloud route to Ollama Cloud compatibility mode; preserving its persisted legacy identity",
+            );
+        }
         self.migrated_legacy_ollama_cloud_route = identity.migrated_legacy_ollama_cloud_route;
         self.provider = Some(identity.key.clone());
         if identity.provider == ApiProvider::Custom
@@ -10479,6 +10511,9 @@ fn merge_config(base: Config, override_cfg: Config) -> Config {
         api_key: override_cfg.api_key.or(base.api_key),
         base_url: override_cfg.base_url.or(base.base_url),
         http_headers: override_cfg.http_headers.or(base.http_headers),
+        request_idempotency_header: override_cfg
+            .request_idempotency_header
+            .or(base.request_idempotency_header),
         default_text_model: override_cfg.default_text_model.or(base.default_text_model),
         auth_mode: override_cfg.auth_mode.or(base.auth_mode),
         reasoning_effort: override_cfg.reasoning_effort.or(base.reasoning_effort),