From 9b31aca0c4ab031b0851a8a2d7a18e548ab32c57 Mon Sep 17 00:00:00 2001
From: LZHS <lzhs@LZHSdeMacBook-Pro-5.local>
Date: Thu, 30 Jul 2026 07:19:21 +0530
Subject: [PATCH 1/3] feat(auth): add dormant egress-bound login v2

---
 admin-ui/src/api/credentials.ts               |  31 +-
 admin-ui/src/components/idc-login-dialog.tsx  |  66 ++-
 .../src/components/social-login-dialog.tsx    |  91 +++-
 admin-ui/src/types/api.ts                     |  22 +-
 src/admin/handlers.rs                         |  38 +-
 src/admin/router.rs                           |   4 +-
 src/admin/service.rs                          | 453 +++++++++++++++---
 src/admin/types.rs                            |  50 +-
 src/kiro/egress_login.rs                      | 174 +++++++
 src/kiro/mod.rs                               |   1 +
 src/kiro/model/credentials.rs                 |  32 ++
 src/kiro/token_manager.rs                     |  30 +-
 12 files changed, 879 insertions(+), 113 deletions(-)
 create mode 100644 src/kiro/egress_login.rs

diff --git a/admin-ui/src/api/credentials.ts b/admin-ui/src/api/credentials.ts
index 7e8c0099..9ba8d9c7 100644
--- a/admin-ui/src/api/credentials.ts
+++ b/admin-ui/src/api/credentials.ts
@@ -24,6 +24,7 @@ import type {
   ProxyCheckAllResponse,
   AssignRoundRobinResponse,
   StartIdcLoginRequest,
+  EgressLoginCapabilityResponse,
   StartIdcLoginResponse,
   PollIdcLoginResponse,
   StartSocialLoginRequest,
@@ -555,6 +556,11 @@ export async function setLogGovernanceConfig(
 }
 
 // 发起 IdC 设备授权登录
+export async function getEgressLoginCapability(): Promise<EgressLoginCapabilityResponse> {
+  const { data } = await api.get<EgressLoginCapabilityResponse>('/auth/egress-login-v2')
+  return data
+}
+
 export async function startIdcLogin(
   req: StartIdcLoginRequest
 ): Promise<StartIdcLoginResponse> {
@@ -563,8 +569,13 @@ export async function startIdcLogin(
 }
 
 // 轮询 IdC 登录状态
-export async function pollIdcLogin(sessionId: string): Promise<PollIdcLoginResponse> {
-  const { data } = await api.post<PollIdcLoginResponse>(`/auth/idc/poll/${sessionId}`)
+export async function pollIdcLogin(
+  sessionId: string,
+  sessionNonce?: string,
+): Promise<PollIdcLoginResponse> {
+  const { data } = await api.post<PollIdcLoginResponse>(`/auth/idc/poll/${sessionId}`, undefined, {
+    headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined,
+  })
   return data
 }
 
@@ -645,17 +656,25 @@ export async function startSocialLogin(
 }
 
 // 轮询 Social 登录状态
-export async function pollSocialLogin(sessionId: string): Promise<PollSocialLoginResponse> {
-  const { data } = await api.post<PollSocialLoginResponse>(`/auth/social/poll/${sessionId}`)
+export async function pollSocialLogin(
+  sessionId: string,
+  sessionNonce?: string,
+): Promise<PollSocialLoginResponse> {
+  const { data } = await api.post<PollSocialLoginResponse>(`/auth/social/poll/${sessionId}`, undefined, {
+    headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined,
+  })
   return data
 }
 
 // 手动完成 Social 登录（远程访问时粘贴回调 URL）
 export async function completeSocialLogin(
   sessionId: string,
-  req: CompleteSocialLoginRequest
+  req: CompleteSocialLoginRequest,
+  sessionNonce?: string,
 ): Promise<PollSocialLoginResponse> {
-  const { data } = await api.post<PollSocialLoginResponse>(`/auth/social/complete/${sessionId}`, req)
+  const { data } = await api.post<PollSocialLoginResponse>(`/auth/social/complete/${sessionId}`, req, {
+    headers: sessionNonce ? { 'x-kiro-egress-nonce': sessionNonce } : undefined,
+  })
   return data
 }
 
diff --git a/admin-ui/src/components/idc-login-dialog.tsx b/admin-ui/src/components/idc-login-dialog.tsx
index 4304e26c..59a93323 100644
--- a/admin-ui/src/components/idc-login-dialog.tsx
+++ b/admin-ui/src/components/idc-login-dialog.tsx
@@ -1,5 +1,6 @@
 import { useState, useEffect, useRef } from 'react'
 import { toast } from 'sonner'
+import { useQuery } from '@tanstack/react-query'
 import { ExternalLink, Copy, Loader2, CheckCircle, Check } from 'lucide-react'
 import {
   Dialog,
@@ -20,7 +21,7 @@ import {
 } from '@/components/ui/select'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
-import { startIdcLogin, pollIdcLogin } from '@/api/credentials'
+import { startIdcLogin, pollIdcLogin, getProxyPool, getEgressLoginCapability } from '@/api/credentials'
 import type { StartIdcLoginResponse } from '@/types/api'
 import { extractErrorMessage } from '@/lib/utils'
 
@@ -139,7 +140,21 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
   const [isStarting, setIsStarting] = useState(false)
   const [session, setSession] = useState<StartIdcLoginResponse | null>(null)
   const [credentialId, setCredentialId] = useState<number | null>(null)
+  const [proxyId, setProxyId] = useState('')
+  const sessionNonceRef = useRef<string | undefined>(undefined)
   const pollTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
+  const { data: proxyPool } = useQuery({
+    queryKey: ['proxy-pool'],
+    queryFn: getProxyPool,
+    enabled: open,
+  })
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
+  const enabledProxies = proxyPool?.proxies.filter((proxy) => proxy.enabled) ?? []
 
   // 清理轮询定时器
   useEffect(() => {
@@ -157,6 +172,8 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
       setCredentialId(null)
       setIsStarting(false)
       setLinkCopied(false)
+      setProxyId('')
+      sessionNonceRef.current = undefined
     }
     onOpenChange(v)
   }
@@ -189,13 +206,15 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
         region: region.trim(),
         startUrl: startUrl.trim() || undefined,
         email: email.trim() || undefined,
+        proxyId: egressEnabled && proxyId ? Number(proxyId) : undefined,
       })
+      sessionNonceRef.current = resp.sessionNonce
       setSession(resp)
       setStep('waiting')
       if (incognito) {
         await copyVerificationUrl(resp)
       }
-      schedulePoll(resp.sessionId, resp.pollInterval)
+      schedulePoll(resp.sessionId, resp.pollInterval, resp.sessionNonce)
     } catch (e) {
       toast.error('发起登录失败：' + extractErrorMessage(e))
     } finally {
@@ -203,12 +222,19 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
     }
   }
 
-  const schedulePoll = (sessionId: string, interval: number) => {
+  const schedulePoll = (sessionId: string, interval: number, sessionNonce?: string) => {
     pollTimerRef.current = setTimeout(async () => {
       try {
-        const result = await pollIdcLogin(sessionId)
+        const result = await pollIdcLogin(sessionId, sessionNonce)
+        const nextNonce = result.status === 'pending' || result.status === 'continue'
+          ? (result.sessionNonce ?? sessionNonce)
+          : undefined
+        sessionNonceRef.current = nextNonce
+        setSession((current) => current && current.sessionId === sessionId
+          ? { ...current, sessionNonce: nextNonce }
+          : current)
         if (result.status === 'pending') {
-          schedulePoll(sessionId, interval)
+          schedulePoll(sessionId, interval, nextNonce)
         } else if (result.status === 'success') {
           setCredentialId(result.credentialId)
           setStep('done')
@@ -221,7 +247,13 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
         }
       } catch (e) {
         toast.error('轮询状态失败：' + extractErrorMessage(e))
-        schedulePoll(sessionId, interval)
+        if (sessionNonce) {
+          setStep('form')
+          setSession(null)
+          sessionNonceRef.current = undefined
+        } else {
+          schedulePoll(sessionId, interval)
+        }
       }
     }, interval * 1000)
   }
@@ -298,6 +330,24 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
           </div>
         )}
 
+        {step === 'form' && egressEnabled && (
+          <div className="space-y-1.5">
+            <label htmlFor="idc-egress-proxy" className="text-sm font-medium">授权出口</label>
+            <Select value={proxyId} onValueChange={setProxyId}>
+              <SelectTrigger id="idc-egress-proxy">
+                <SelectValue placeholder="选择托管代理" />
+              </SelectTrigger>
+              <SelectContent>
+                {enabledProxies.map((proxy) => (
+                  <SelectItem key={proxy.id} value={String(proxy.id)}>
+                    {proxy.label || `代理 #${proxy.id}`}
+                  </SelectItem>
+                ))}
+              </SelectContent>
+            </Select>
+          </div>
+        )}
+
         {step === 'form' && (
           <label className="flex items-start gap-2 rounded-lg border bg-muted/40 p-3 cursor-pointer">
             <input
@@ -374,14 +424,14 @@ export function IdcLoginDialog({ open, onOpenChange, onSuccess, mode = 'builder-
             <CheckCircle className="h-10 w-10 text-green-500" />
             <p className="text-sm font-medium">登录成功</p>
             <p className="text-xs text-muted-foreground">
-              凭据 #{credentialId} 已添加并启用
+              凭据 #{credentialId} 已添加{session?.slotId ? '并隔离' : '并启用'}
             </p>
           </div>
         )}
 
         <DialogFooter>
           {step === 'form' && (
-            <Button onClick={handleStart} disabled={isStarting}>
+            <Button onClick={handleStart} disabled={isStarting || (egressEnabled && !proxyId)}>
               {isStarting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
               发起登录
             </Button>
diff --git a/admin-ui/src/components/social-login-dialog.tsx b/admin-ui/src/components/social-login-dialog.tsx
index c096a773..1112e620 100644
--- a/admin-ui/src/components/social-login-dialog.tsx
+++ b/admin-ui/src/components/social-login-dialog.tsx
@@ -1,5 +1,6 @@
 import { useState, useEffect, useRef } from 'react'
 import { toast } from 'sonner'
+import { useQuery } from '@tanstack/react-query'
 import { ExternalLink, CheckCircle, Loader2, Copy, Check } from 'lucide-react'
 import {
   Dialog,
@@ -11,7 +12,20 @@ import {
 } from '@/components/ui/dialog'
 import { Button } from '@/components/ui/button'
 import { Input } from '@/components/ui/input'
-import { startSocialLogin, pollSocialLogin, completeSocialLogin } from '@/api/credentials'
+import {
+  Select,
+  SelectContent,
+  SelectItem,
+  SelectTrigger,
+  SelectValue,
+} from '@/components/ui/select'
+import {
+  startSocialLogin,
+  pollSocialLogin,
+  completeSocialLogin,
+  getProxyPool,
+  getEgressLoginCapability,
+} from '@/api/credentials'
 import type { StartSocialLoginResponse } from '@/types/api'
 import { extractErrorMessage } from '@/lib/utils'
 
@@ -96,9 +110,23 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
   const [credentialId, setCredentialId] = useState<number | null>(null)
   const [callbackUrl, setCallbackUrl] = useState('')
   const [nextUrl, setNextUrl] = useState('')
+  const [proxyId, setProxyId] = useState('')
+  const sessionNonceRef = useRef<string | undefined>(undefined)
   const pollTimerRef = useRef<ReturnType<typeof setTimeout> | null>(null)
   const loginLinkRef = useRef<HTMLTextAreaElement | null>(null)
   const isRemote = isRemoteAccess()
+  const { data: proxyPool } = useQuery({
+    queryKey: ['proxy-pool'],
+    queryFn: getProxyPool,
+    enabled: open,
+  })
+  const { data: egressCapability } = useQuery({
+    queryKey: ['egress-login-v2'],
+    queryFn: getEgressLoginCapability,
+    enabled: open,
+  })
+  const egressEnabled = egressCapability?.enabled === true
+  const enabledProxies = proxyPool?.proxies.filter((proxy) => proxy.enabled) ?? []
 
   const clearPollTimer = () => {
     if (pollTimerRef.current) {
@@ -122,6 +150,8 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
       setCallbackUrl('')
       setNextUrl('')
       setCopyState('idle')
+      setProxyId('')
+      sessionNonceRef.current = undefined
     }
     onOpenChange(v)
   }
@@ -177,7 +207,9 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
     try {
       const resp = await startSocialLogin({
         email: email.trim() || undefined,
+        proxyId: egressEnabled && proxyId ? Number(proxyId) : undefined,
       })
+      sessionNonceRef.current = resp.sessionNonce
       setSession(resp)
       setStep('waiting')
       if (incognito) {
@@ -189,7 +221,7 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
         window.open(resp.portalUrl, '_blank')
       }
       // 回调可能自动投递，也可能需要手动粘贴；始终轮询以便及时展示企业 SSO 二段链接。
-      schedulePoll(resp.sessionId)
+      schedulePoll(resp.sessionId, resp.sessionNonce)
     } catch (e) {
       loginWindow?.close()
       toast.error('发起登录失败：' + extractErrorMessage(e))
@@ -198,24 +230,31 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
     }
   }
 
-  const schedulePoll = (sessionId: string) => {
+  const schedulePoll = (sessionId: string, sessionNonce?: string) => {
     clearPollTimer()
     pollTimerRef.current = setTimeout(async () => {
       try {
-        const result = await pollSocialLogin(sessionId)
+        const result = await pollSocialLogin(sessionId, sessionNonce)
+        const nextNonce = result.status === 'pending' || result.status === 'continue'
+          ? (result.sessionNonce ?? sessionNonce)
+          : undefined
+        sessionNonceRef.current = nextNonce
+        setSession((current) => current && current.sessionId === sessionId
+          ? { ...current, sessionNonce: nextNonce }
+          : current)
         if (result.status === 'pending') {
-          schedulePoll(sessionId)
+          schedulePoll(sessionId, nextNonce)
         } else if (result.status === 'continue') {
           const next = getContinueUrl(result)
           if (!next) {
             toast.error('后端返回了二段登录状态，但没有返回链接')
-            schedulePoll(sessionId)
+            schedulePoll(sessionId, nextNonce)
             return
           }
           setNextUrl(next)
           setCopyState('idle')
           toast.success('已获取二段登录链接，请点击打开或复制')
-          schedulePoll(sessionId)
+          schedulePoll(sessionId, nextNonce)
         } else if (result.status === 'success') {
           setCredentialId(result.credentialId)
           setStep('done')
@@ -228,7 +267,13 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
         }
       } catch (e) {
         toast.error('轮询失败：' + extractErrorMessage(e))
-        schedulePoll(sessionId)
+        if (sessionNonce) {
+          setStep('form')
+          setSession(null)
+          sessionNonceRef.current = undefined
+        } else {
+          schedulePoll(sessionId)
+        }
       }
     }, POLL_INTERVAL_MS)
   }
@@ -252,8 +297,13 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
         clientId: parsed.clientId,
         scopes: parsed.scopes,
         loginHint: parsed.loginHint,
-      })
+      }, sessionNonceRef.current)
       if (result.status === 'continue') {
+        const nextNonce = result.sessionNonce ?? sessionNonceRef.current
+        sessionNonceRef.current = nextNonce
+        setSession((current) => current
+          ? { ...current, sessionNonce: nextNonce }
+          : current)
         const next = getContinueUrl(result)
         if (!next) {
           toast.error('后端返回了二段登录状态，但没有返回链接')
@@ -263,7 +313,7 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
         setCopyState('idle')
         setCallbackUrl('')
         toast.success('已获取二段登录链接，请点击打开或复制')
-        schedulePoll(session.sessionId)
+        schedulePoll(session.sessionId, nextNonce)
       } else if (result.status === 'success') {
         setCredentialId(result.credentialId)
         setStep('done')
@@ -302,6 +352,21 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
                 onChange={(e) => setEmail(e.target.value)}
               />
             </div>
+            {egressEnabled && <div className="space-y-1.5">
+              <label htmlFor="social-egress-proxy" className="text-sm font-medium">授权出口</label>
+              <Select value={proxyId} onValueChange={setProxyId}>
+                <SelectTrigger id="social-egress-proxy">
+                  <SelectValue placeholder="选择托管代理" />
+                </SelectTrigger>
+                <SelectContent>
+                  {enabledProxies.map((proxy) => (
+                    <SelectItem key={proxy.id} value={String(proxy.id)}>
+                      {proxy.label || `代理 #${proxy.id}`}
+                    </SelectItem>
+                  ))}
+                </SelectContent>
+              </Select>
+            </div>}
             <label className="flex items-start gap-2 rounded-lg border bg-muted/40 p-3 cursor-pointer">
               <input
                 type="checkbox"
@@ -435,13 +500,15 @@ export function SocialLoginDialog({ open, onOpenChange, onSuccess }: SocialLogin
           <div className="flex flex-col items-center gap-3 py-4">
             <CheckCircle className="h-10 w-10 text-green-500" />
             <p className="text-sm font-medium">登录成功</p>
-            <p className="text-xs text-muted-foreground">凭据 #{credentialId} 已添加并启用</p>
+            <p className="text-xs text-muted-foreground">
+              凭据 #{credentialId} 已添加{session?.slotId ? '并隔离' : '并启用'}
+            </p>
           </div>
         )}
 
         <DialogFooter>
           {step === 'form' && (
-            <Button onClick={handleStart} disabled={isStarting}>
+            <Button onClick={handleStart} disabled={isStarting || (egressEnabled && !proxyId)}>
               {isStarting && <Loader2 className="mr-2 h-4 w-4 animate-spin" />}
               发起登录
             </Button>
diff --git a/admin-ui/src/types/api.ts b/admin-ui/src/types/api.ts
index 33bae055..fcbd93f8 100644
--- a/admin-ui/src/types/api.ts
+++ b/admin-ui/src/types/api.ts
@@ -338,12 +338,18 @@ export interface UpdateAdminKeyRequest {
 }
 
 // IdC 设备授权登录
+export interface EgressLoginCapabilityResponse {
+  enabled: boolean
+}
+
 export interface StartIdcLoginRequest {
   region: string
   startUrl?: string
   priority?: number
   email?: string
   proxyUrl?: string
+  proxyId?: number
+  browserEgressIp?: string
 }
 
 export interface StartIdcLoginResponse {
@@ -353,11 +359,16 @@ export interface StartIdcLoginResponse {
   verificationUriComplete?: string
   expiresAt: string
   pollInterval: number
+  sessionNonce?: string
+  slotId?: string
+  proxyId?: number
+  egressFingerprint?: string
+  browserEgressStatus?: 'verified' | 'unverified'
 }
 
 export type PollIdcLoginResponse =
-  | { status: 'pending' }
-  | { status: 'continue'; nextUrl: string }
+  | { status: 'pending'; sessionNonce?: string }
+  | { status: 'continue'; nextUrl: string; sessionNonce?: string }
   | { status: 'success'; credentialId: number }
   | { status: 'expired' }
 
@@ -367,6 +378,8 @@ export interface StartSocialLoginRequest {
   email?: string
   proxyUrl?: string
   authEndpoint?: string
+  proxyId?: number
+  browserEgressIp?: string
 }
 
 /** 远程访问时手动完成 Social 登录：从浏览器地址栏粘贴的回调 URL 中提取参数 */
@@ -385,6 +398,11 @@ export interface StartSocialLoginResponse {
   sessionId: string
   portalUrl: string
   expiresAt: string
+  sessionNonce?: string
+  slotId?: string
+  proxyId?: number
+  egressFingerprint?: string
+  browserEgressStatus?: 'verified' | 'unverified'
 }
 
 export type PollSocialLoginResponse = PollIdcLoginResponse
diff --git a/src/admin/handlers.rs b/src/admin/handlers.rs
index baff032c..dd75b743 100644
--- a/src/admin/handlers.rs
+++ b/src/admin/handlers.rs
@@ -6,7 +6,7 @@ use axum::{
     Json,
     body::Body,
     extract::{Path, Query, State},
-    http::{StatusCode, header},
+    http::{HeaderMap, StatusCode, header},
     response::{IntoResponse, Response},
 };
 use bytes::Bytes;
@@ -23,6 +23,7 @@ use super::{
         BatchAddProxyRequest, BatchImportEvent, BatchImportRequest, BatchImportSummary,
         ClientKeyItem, ClientKeysResponse, CompleteSocialLoginRequest, CreateClientKeyRequest,
         CreateClientKeyResponse, CredentialResponseTestRequest, GlobalProxyResponse,
+        EgressLoginCapabilityResponse,
         ProxyCheckUrlRequest, SetAccountThrottleConfigRequest, SetDisabledRequest,
         SetGlobalProxyRequest, SetLoadBalancingModeRequest, SetLogGovernanceConfigRequest,
         SetPriorityRequest, SetProxyBalancingModeRequest, SetRetryPolicyRequest,
@@ -36,6 +37,18 @@ use super::{
 // Path 元组提取：(credential_id, session_id)
 type CredSessionPath = (u64, String);
 
+fn egress_session_nonce(headers: &HeaderMap) -> Option<&str> {
+    headers
+        .get("x-kiro-egress-nonce")
+        .and_then(|value| value.to_str().ok())
+}
+
+pub async fn get_egress_login_capability() -> Json<EgressLoginCapabilityResponse> {
+    Json(EgressLoginCapabilityResponse {
+        enabled: crate::kiro::egress_login::enabled(),
+    })
+}
+
 /// GET /api/admin/credentials
 /// 获取所有凭据状态
 pub async fn get_all_credentials(State(state): State<AdminState>) -> impl IntoResponse {
@@ -661,8 +674,13 @@ pub async fn start_idc_login(
 pub async fn poll_idc_login(
     State(state): State<AdminState>,
     Path(session_id): Path<String>,
+    headers: HeaderMap,
 ) -> impl IntoResponse {
-    match state.service.poll_idc_login(&session_id).await {
+    match state
+        .service
+        .poll_idc_login(&session_id, egress_session_nonce(&headers))
+        .await
+    {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
@@ -685,8 +703,13 @@ pub async fn start_social_login(
 pub async fn poll_social_login(
     State(state): State<AdminState>,
     Path(session_id): Path<String>,
+    headers: HeaderMap,
 ) -> impl IntoResponse {
-    match state.service.poll_social_login(&session_id).await {
+    match state
+        .service
+        .poll_social_login(&session_id, egress_session_nonce(&headers))
+        .await
+    {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
@@ -699,11 +722,12 @@ pub async fn poll_social_login(
 pub async fn complete_social_login(
     State(state): State<AdminState>,
     Path(session_id): Path<String>,
+    headers: HeaderMap,
     Json(payload): Json<CompleteSocialLoginRequest>,
 ) -> impl IntoResponse {
     match state
         .service
-        .complete_social_login(&session_id, payload)
+        .complete_social_login(&session_id, payload, egress_session_nonce(&headers))
         .await
     {
         Ok(response) => Json(response).into_response(),
@@ -817,7 +841,7 @@ pub async fn poll_social_relogin(
     State(state): State<AdminState>,
     Path((_, session_id)): Path<CredSessionPath>,
 ) -> impl IntoResponse {
-    match state.service.poll_social_login(&session_id).await {
+    match state.service.poll_social_login(&session_id, None).await {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
@@ -832,7 +856,7 @@ pub async fn complete_social_relogin(
 ) -> impl IntoResponse {
     match state
         .service
-        .complete_social_login(&session_id, payload)
+        .complete_social_login(&session_id, payload, None)
         .await
     {
         Ok(response) => Json(response).into_response(),
@@ -859,7 +883,7 @@ pub async fn poll_idc_relogin(
     State(state): State<AdminState>,
     Path((_, session_id)): Path<CredSessionPath>,
 ) -> impl IntoResponse {
-    match state.service.poll_idc_login(&session_id).await {
+    match state.service.poll_idc_login(&session_id, None).await {
         Ok(response) => Json(response).into_response(),
         Err(e) => (e.status_code(), Json(e.into_response())).into_response(),
     }
diff --git a/src/admin/router.rs b/src/admin/router.rs
index d018a8a3..5dea3b9a 100644
--- a/src/admin/router.rs
+++ b/src/admin/router.rs
@@ -14,7 +14,8 @@ use super::{
         complete_social_login, complete_social_relogin, create_client_key, create_group,
         delete_client_key, delete_credential, delete_group, delete_proxy, disable_quota_exceeded,
         enable_overage_all, export_credentials, force_refresh_token, get_account_throttle_config,
-        get_all_credentials, get_credential_balance, get_credential_models, get_global_proxy,
+        get_all_credentials, get_credential_balance, get_credential_models,
+        get_egress_login_capability, get_global_proxy,
         get_load_balancing_mode, get_log_governance_config, get_proxy_balancing_mode,
         delete_model_mapping, get_proxy_pool, get_retry_policy, get_update_config, list_client_keys,
         list_groups, list_model_mappings, list_traces, poll_idc_login, poll_idc_relogin,
@@ -135,6 +136,7 @@ pub fn create_admin_router(state: AdminState) -> Router {
         .route("/system/update/check", get(check_update))
         .route("/system/update/rate-limit", post(check_rate_limit))
         .route("/auth/idc/start", post(start_idc_login))
+        .route("/auth/egress-login-v2", get(get_egress_login_capability))
         .route("/auth/idc/poll/{session_id}", post(poll_idc_login))
         .route("/auth/social/start", post(start_social_login))
         .route("/auth/social/poll/{session_id}", post(poll_social_login))
diff --git a/src/admin/service.rs b/src/admin/service.rs
index f2e50236..3cfe578c 100644
--- a/src/admin/service.rs
+++ b/src/admin/service.rs
@@ -12,6 +12,7 @@ use uuid::Uuid;
 use crate::http_client::ProxyConfig;
 use crate::kiro::auth::idc::{self, BUILDER_ID_START_URL};
 use crate::kiro::auth::social;
+use crate::kiro::egress_login;
 use crate::kiro::error::UpstreamRateLimitError;
 use crate::kiro::model::credentials::KiroCredentials;
 use crate::kiro::model::credentials::{
@@ -223,6 +224,7 @@ struct SocialAuthSession {
     _server_handle: social::ServerHandle,
     /// 重新登录时更新此凭据的 Token（非 None 时更新已有凭据而非创建新凭据）
     relogin_target_id: Option<u64>,
+    egress: Option<LoginEgressBinding>,
 }
 
 #[derive(Debug, Clone)]
@@ -251,6 +253,28 @@ struct IdcAuthSession {
     proxy: Option<ProxyConfig>,
     /// 重新登录时更新此凭据的 Token（非 None 时更新已有凭据而非创建新凭据）
     relogin_target_id: Option<u64>,
+    egress: Option<LoginEgressBinding>,
+}
+
+#[derive(Debug, Clone)]
+struct LoginEgressBinding {
+    slot_id: String,
+    proxy_id: u64,
+    proxy_version: String,
+    fingerprint: String,
+    browser_status: egress_login::BrowserEgressStatus,
+    nonce_hash: String,
+    nonce_claimed: bool,
+}
+
+impl LoginEgressBinding {
+    fn apply_to_credential(&self, credential: &mut KiroCredentials) {
+        credential.login_slot_id = Some(self.slot_id.clone());
+        credential.egress_proxy_id = Some(self.proxy_id);
+        credential.egress_proxy_version = Some(self.proxy_version.clone());
+        credential.egress_fingerprint = Some(self.fingerprint.clone());
+        credential.disabled = true;
+    }
 }
 
 /// 解析自动更新触发时间（`HH:MM`，本地 24 小时制）。允许 `H:M` 简写，
@@ -580,6 +604,155 @@ impl AdminService {
         self
     }
 
+    async fn prepare_login_egress(
+        &self,
+        proxy_id: Option<u64>,
+        browser_egress_ip: Option<&str>,
+    ) -> Result<(LoginEgressBinding, ProxyConfig, String), AdminServiceError> {
+        let proxy_id = proxy_id.ok_or_else(|| {
+            AdminServiceError::InvalidCredential(
+                "egress login v2 要求先选择托管代理 proxyId".to_string(),
+            )
+        })?;
+        let proxy_url = match self.proxy_pool.get_url(proxy_id) {
+            GetUrlResult::Ok(url) => url,
+            GetUrlResult::NotFound => return Err(AdminServiceError::NotFound { id: proxy_id }),
+            GetUrlResult::Disabled => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "选定代理已禁用".to_string(),
+                ));
+            }
+        };
+        let proxy = ProxyConfig::new(proxy_url);
+        let probe = egress_login::probe(
+            proxy_id,
+            &proxy,
+            browser_egress_ip,
+            self.token_manager.config().tls_backend,
+        )
+        .await
+        .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+        let (nonce, nonce_hash) = egress_login::new_nonce();
+        Ok((
+            LoginEgressBinding {
+                slot_id: format!("kiro-rs-{}", Uuid::new_v4()),
+                proxy_id,
+                proxy_version: probe.proxy_version,
+                fingerprint: probe.fingerprint,
+                browser_status: probe.browser_status,
+                nonce_hash,
+                nonce_claimed: false,
+            },
+            proxy,
+            nonce,
+        ))
+    }
+
+    async fn verify_login_egress(
+        &self,
+        binding: &LoginEgressBinding,
+        proxy: Option<&ProxyConfig>,
+    ) -> Result<(), AdminServiceError> {
+        let current_url = match self.proxy_pool.get_url(binding.proxy_id) {
+            GetUrlResult::Ok(url) => url,
+            GetUrlResult::NotFound | GetUrlResult::Disabled => {
+                return Err(AdminServiceError::InvalidCredential(
+                    "egress login 绑定的代理已删除或禁用".to_string(),
+                ));
+            }
+        };
+        let proxy = proxy.ok_or_else(|| {
+            AdminServiceError::InvalidCredential("egress login 会话缺少绑定代理".to_string())
+        })?;
+        if egress_login::proxy_version(binding.proxy_id, &current_url) != binding.proxy_version
+            || current_url != proxy.url
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress login 会话代理版本发生漂移".to_string(),
+            ));
+        }
+        let observed = egress_login::probe(
+            binding.proxy_id,
+            proxy,
+            None,
+            self.token_manager.config().tls_backend,
+        )
+        .await
+        .map_err(|error| AdminServiceError::UpstreamError(error.to_string()))?;
+        if observed.proxy_version != binding.proxy_version
+            || observed.fingerprint != binding.fingerprint
+        {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress login 会话出口发生漂移".to_string(),
+            ));
+        }
+        Ok(())
+    }
+
+    fn claim_social_nonce(
+        &self,
+        session_id: &str,
+        session_nonce: Option<&str>,
+    ) -> Result<Option<(LoginEgressBinding, Option<ProxyConfig>)>, AdminServiceError> {
+        let mut sessions = self.social_sessions.lock();
+        let session = sessions
+            .get_mut(session_id)
+            .ok_or(AdminServiceError::NotFound { id: 0 })?;
+        let Some(binding) = session.egress.as_mut() else {
+            return Ok(None);
+        };
+        if binding.nonce_claimed {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress login session nonce 已使用".to_string(),
+            ));
+        }
+        egress_login::verify_nonce(&binding.nonce_hash, session_nonce)
+            .map_err(|error| AdminServiceError::InvalidCredential(error.to_string()))?;
+        binding.nonce_claimed = true;
+        Ok(Some((binding.clone(), session.proxy.clone())))
+    }
+
+    fn rotate_social_nonce(&self, session_id: &str) -> Option<String> {
+        let mut sessions = self.social_sessions.lock();
+        let binding = sessions.get_mut(session_id)?.egress.as_mut()?;
+        let (nonce, nonce_hash) = egress_login::new_nonce();
+        binding.nonce_hash = nonce_hash;
+        binding.nonce_claimed = false;
+        Some(nonce)
+    }
+
+    fn claim_idc_nonce(
+        &self,
+        session_id: &str,
+        session_nonce: Option<&str>,
+    ) -> Result<Option<(LoginEgressBinding, Option<ProxyConfig>)>, AdminServiceError> {
+        let mut sessions = self.idc_sessions.lock();
+        let session = sessions
+            .get_mut(session_id)
+            .ok_or(AdminServiceError::NotFound { id: 0 })?;
+        let Some(binding) = session.egress.as_mut() else {
+            return Ok(None);
+        };
+        if binding.nonce_claimed {
+            return Err(AdminServiceError::InvalidCredential(
+                "egress login session nonce 已使用".to_string(),
+            ));
+        }
+        egress_login::verify_nonce(&binding.nonce_hash, session_nonce)
+            .map_err(|error| AdminServiceError::InvalidCredential(error.to_string()))?;
+        binding.nonce_claimed = true;
+        Ok(Some((binding.clone(), session.proxy.clone())))
+    }
+
+    fn rotate_idc_nonce(&self, session_id: &str) -> Option<String> {
+        let mut sessions = self.idc_sessions.lock();
+        let binding = sessions.get_mut(session_id)?.egress.as_mut()?;
+        let (nonce, nonce_hash) = egress_login::new_nonce();
+        binding.nonce_hash = nonce_hash;
+        binding.nonce_claimed = false;
+        Some(nonce)
+    }
+
     /// 获取所有凭据状态
     pub fn get_all_credentials(&self) -> CredentialsStatusResponse {
         let snapshot = self.token_manager.snapshot();
@@ -1216,6 +1389,10 @@ impl AdminService {
             endpoint: req.endpoint,
             groups: req.groups,
             source_channel: req.source_channel,
+            login_slot_id: None,
+            egress_proxy_id: None,
+            egress_proxy_version: None,
+            egress_fingerprint: None,
         };
 
         // 调用 token_manager 添加凭据
@@ -2721,12 +2898,19 @@ impl AdminService {
         &self,
         req: StartSocialLoginRequest,
     ) -> Result<StartSocialLoginResponse, AdminServiceError> {
-        let global_proxy = self.token_manager.proxy();
-        let proxy = req
-            .proxy_url
-            .as_deref()
-            .map(ProxyConfig::new)
-            .or(global_proxy);
+        let (egress, proxy, session_nonce) = if egress_login::enabled() {
+            let (binding, proxy, nonce) = self
+                .prepare_login_egress(req.proxy_id, req.browser_egress_ip.as_deref())
+                .await?;
+            (Some(binding), Some(proxy), Some(nonce))
+        } else {
+            let global_proxy = self.token_manager.proxy();
+            (
+                None,
+                req.proxy_url.as_deref().map(ProxyConfig::new).or(global_proxy),
+                None,
+            )
+        };
 
         let auth_endpoint = req
             .auth_endpoint
@@ -2748,14 +2932,17 @@ impl AdminService {
         let expires_at = Utc::now() + Duration::minutes(10);
         let session_id = uuid::Uuid::new_v4().to_string();
 
-        let cred_template = KiroCredentials {
+        let mut cred_template = KiroCredentials {
             auth_method: Some("social".to_string()),
             priority: req.priority,
             rpm_limit: 10, // 默认每分钟 10 次（与普通添加一致；用户可在面板调整）
             email: req.email,
-            proxy_url: req.proxy_url,
+            proxy_url: proxy.as_ref().map(|value| value.url.clone()),
             ..Default::default()
         };
+        if let Some(binding) = &egress {
+            binding.apply_to_credential(&mut cred_template);
+        }
 
         let session = SocialAuthSession {
             auth_endpoint,
@@ -2769,6 +2956,7 @@ impl AdminService {
             proxy,
             _server_handle: server_handle,
             relogin_target_id: None,
+            egress: egress.clone(),
         };
 
         self.social_sessions
@@ -2779,6 +2967,13 @@ impl AdminService {
             session_id,
             portal_url,
             expires_at: expires_at.to_rfc3339(),
+            session_nonce,
+            slot_id: egress.as_ref().map(|value| value.slot_id.clone()),
+            proxy_id: egress.as_ref().map(|value| value.proxy_id),
+            egress_fingerprint: egress.as_ref().map(|value| value.fingerprint.clone()),
+            browser_egress_status: egress
+                .as_ref()
+                .map(|value| value.browser_status.as_str().to_string()),
         })
     }
 
@@ -2786,6 +2981,7 @@ impl AdminService {
     pub async fn poll_social_login(
         &self,
         session_id: &str,
+        session_nonce: Option<&str>,
     ) -> Result<PollIdcLoginResponse, AdminServiceError> {
         use tokio::sync::mpsc::error::TryRecvError;
 
@@ -2797,6 +2993,14 @@ impl AdminService {
             Received(social::OAuthCallbackData),
         }
 
+        let claimed = self.claim_social_nonce(session_id, session_nonce)?;
+        if let Some((binding, proxy)) = &claimed {
+            if let Err(error) = self.verify_login_egress(binding, proxy.as_ref()).await {
+                self.social_sessions.lock().remove(session_id);
+                return Err(error);
+            }
+        }
+
         let outcome = {
             let sessions = self.social_sessions.lock();
             let Some(session) = sessions.get(session_id) else {
@@ -2818,7 +3022,11 @@ impl AdminService {
         };
 
         match outcome {
-            PollOutcome::Pending => return Ok(PollIdcLoginResponse::Pending),
+            PollOutcome::Pending => {
+                return Ok(PollIdcLoginResponse::Pending {
+                    session_nonce: self.rotate_social_nonce(session_id),
+                });
+            }
             PollOutcome::Expired => {
                 self.social_sessions.lock().remove(session_id);
                 return Ok(PollIdcLoginResponse::Expired);
@@ -2830,7 +3038,8 @@ impl AdminService {
                 ));
             }
             PollOutcome::Received(callback) => {
-                self.do_complete_social_login(session_id, callback).await
+                self.do_complete_social_login(session_id, callback, None)
+                    .await
             }
         }
     }
@@ -2842,14 +3051,9 @@ impl AdminService {
         &self,
         session_id: &str,
         callback: social::OAuthCallbackData,
+        session_nonce: Option<&str>,
     ) -> Result<PollIdcLoginResponse, AdminServiceError> {
-        if callback.kind == social::OAuthCallbackKind::ExternalIdpDescriptor {
-            return self
-                .handle_external_idp_descriptor(session_id, callback)
-                .await;
-        }
-
-        let is_external_idp_final = {
+        let (is_external_idp_final, egress, proxy) = {
             let sessions = self.social_sessions.lock();
             let s = sessions
                 .get(session_id)
@@ -2857,9 +3061,37 @@ impl AdminService {
             if Utc::now() >= s.expires_at {
                 return Ok(PollIdcLoginResponse::Expired);
             }
-            s.external_idp.is_some() && callback.path == "/oauth/callback"
+            (
+                s.external_idp.is_some() && callback.path == "/oauth/callback",
+                s.egress.clone(),
+                s.proxy.clone(),
+            )
         };
 
+        if let Some(binding) = &egress {
+            if !binding.nonce_claimed {
+                let claimed = self.claim_social_nonce(session_id, session_nonce)?;
+                let Some((binding, proxy)) = claimed else {
+                    return Err(AdminServiceError::InvalidCredential(
+                        "egress login 会话绑定丢失".to_string(),
+                    ));
+                };
+                if let Err(error) = self.verify_login_egress(&binding, proxy.as_ref()).await {
+                    self.social_sessions.lock().remove(session_id);
+                    return Err(error);
+                }
+            } else if let Err(error) = self.verify_login_egress(binding, proxy.as_ref()).await {
+                self.social_sessions.lock().remove(session_id);
+                return Err(error);
+            }
+        }
+
+        if callback.kind == social::OAuthCallbackKind::ExternalIdpDescriptor {
+            return self
+                .handle_external_idp_descriptor(session_id, callback)
+                .await;
+        }
+
         if is_external_idp_final {
             self.finish_external_idp_login(session_id, callback).await
         } else {
@@ -2872,7 +3104,7 @@ impl AdminService {
         session_id: &str,
         callback: social::OAuthCallbackData,
     ) -> Result<PollIdcLoginResponse, AdminServiceError> {
-        let (redirect_uri, proxy) = {
+        let (redirect_uri, proxy, existing_url) = {
             let sessions = self.social_sessions.lock();
             let s = sessions
                 .get(session_id)
@@ -2891,13 +3123,19 @@ impl AdminService {
                 ));
             }
             if let Some(existing) = &s.external_idp {
-                return Ok(PollIdcLoginResponse::Continue {
-                    next_url: existing.authorization_url.clone(),
-                });
+                (s.redirect_uri.clone(), s.proxy.clone(), Some(existing.authorization_url.clone()))
+            } else {
+                (s.redirect_uri.clone(), s.proxy.clone(), None)
             }
-            (s.redirect_uri.clone(), s.proxy.clone())
         };
 
+        if let Some(next_url) = existing_url {
+            return Ok(PollIdcLoginResponse::Continue {
+                next_url,
+                session_nonce: self.rotate_social_nonce(session_id),
+            });
+        }
+
         let config = self.token_manager.config();
         let authorization = social::build_external_idp_authorization(
             &callback,
@@ -2909,27 +3147,32 @@ impl AdminService {
         .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
         let next_url = authorization.authorization_url.clone();
-        let mut sessions = self.social_sessions.lock();
-        let s = sessions
-            .get_mut(session_id)
-            .ok_or(AdminServiceError::NotFound { id: 0 })?;
-        if Utc::now() >= s.expires_at {
-            return Ok(PollIdcLoginResponse::Expired);
-        }
-        if s.external_idp.is_none() {
-            s.external_idp = Some(ExternalIdpLoginState {
-                state: authorization.state,
-                code_verifier: authorization.code_verifier,
-                token_endpoint: authorization.token_endpoint,
-                issuer_url: authorization.issuer_url,
-                client_id: authorization.client_id,
-                scopes: authorization.scopes,
-                redirect_uri: authorization.redirect_uri,
-                authorization_url: next_url.clone(),
-            });
+        {
+            let mut sessions = self.social_sessions.lock();
+            let s = sessions
+                .get_mut(session_id)
+                .ok_or(AdminServiceError::NotFound { id: 0 })?;
+            if Utc::now() >= s.expires_at {
+                return Ok(PollIdcLoginResponse::Expired);
+            }
+            if s.external_idp.is_none() {
+                s.external_idp = Some(ExternalIdpLoginState {
+                    state: authorization.state,
+                    code_verifier: authorization.code_verifier,
+                    token_endpoint: authorization.token_endpoint,
+                    issuer_url: authorization.issuer_url,
+                    client_id: authorization.client_id,
+                    scopes: authorization.scopes,
+                    redirect_uri: authorization.redirect_uri,
+                    authorization_url: next_url.clone(),
+                });
+            }
         }
 
-        Ok(PollIdcLoginResponse::Continue { next_url })
+        Ok(PollIdcLoginResponse::Continue {
+            next_url,
+            session_nonce: self.rotate_social_nonce(session_id),
+        })
     }
 
     async fn finish_social_code_login(
@@ -3021,14 +3264,16 @@ impl AdminService {
             new_cred.profile_arn = Some(arn);
         }
 
-        let credential_id = self
-            .token_manager
-            .add_credential(new_cred)
-            .await
-            .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+        let quarantined = session.egress.is_some();
+        let credential_id = if quarantined {
+            self.token_manager.add_quarantined_credential(new_cred).await
+        } else {
+            self.token_manager.add_credential(new_cred).await
+        }
+        .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
         // 主动刷新余额（含订阅等级 / 邮箱）并写入缓存，登录后立即可见
-        if let Err(e) = self.get_balance(credential_id).await {
+        if !quarantined && let Err(e) = self.get_balance(credential_id).await {
             tracing::warn!("Social 登录后刷新余额失败（不影响登录）: {}", e);
         }
 
@@ -3125,13 +3370,15 @@ impl AdminService {
             new_cred.email = social::extract_email_from_jwt(&token.access_token);
         }
 
-        let credential_id = self
-            .token_manager
-            .add_credential(new_cred)
-            .await
-            .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+        let quarantined = session.egress.is_some();
+        let credential_id = if quarantined {
+            self.token_manager.add_quarantined_credential(new_cred).await
+        } else {
+            self.token_manager.add_credential(new_cred).await
+        }
+        .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
-        if let Err(e) = self.get_balance(credential_id).await {
+        if !quarantined && let Err(e) = self.get_balance(credential_id).await {
             tracing::warn!("External IdP 登录后刷新余额失败（不影响登录）: {}", e);
         }
 
@@ -3144,6 +3391,7 @@ impl AdminService {
         &self,
         session_id: &str,
         req: CompleteSocialLoginRequest,
+        session_nonce: Option<&str>,
     ) -> Result<PollIdcLoginResponse, AdminServiceError> {
         // 过期检查
         {
@@ -3174,7 +3422,18 @@ impl AdminService {
             scopes: req.scopes,
             login_hint: req.login_hint,
         };
-        self.do_complete_social_login(session_id, callback).await
+        let was_egress = self
+            .social_sessions
+            .lock()
+            .get(session_id)
+            .is_some_and(|session| session.egress.is_some());
+        let result = self
+            .do_complete_social_login(session_id, callback, session_nonce)
+            .await;
+        if was_egress && result.is_err() {
+            self.social_sessions.lock().remove(session_id);
+        }
+        result
     }
 
     /// 分类删除凭据错误
@@ -3198,14 +3457,19 @@ impl AdminService {
         req: StartIdcLoginRequest,
     ) -> Result<StartIdcLoginResponse, AdminServiceError> {
         let config = self.token_manager.config();
-        let global_proxy = self.token_manager.proxy();
-
-        // 代理：优先用请求级，否则回退全局
-        let proxy = req
-            .proxy_url
-            .as_deref()
-            .map(ProxyConfig::new)
-            .or(global_proxy);
+        let (egress, proxy, session_nonce) = if egress_login::enabled() {
+            let (binding, proxy, nonce) = self
+                .prepare_login_egress(req.proxy_id, req.browser_egress_ip.as_deref())
+                .await?;
+            (Some(binding), Some(proxy), Some(nonce))
+        } else {
+            let global_proxy = self.token_manager.proxy();
+            (
+                None,
+                req.proxy_url.as_deref().map(ProxyConfig::new).or(global_proxy),
+                None,
+            )
+        };
 
         let start_url = req.start_url.as_deref().unwrap_or(BUILDER_ID_START_URL);
 
@@ -3237,7 +3501,7 @@ impl AdminService {
         };
 
         // 构建登录成功后写入的凭据模板
-        let cred_template = KiroCredentials {
+        let mut cred_template = KiroCredentials {
             auth_method: Some("idc".to_string()),
             provider: Some(provider.to_string()),
             client_id: Some(reg.client_id.clone()),
@@ -3247,9 +3511,12 @@ impl AdminService {
             priority: req.priority,
             rpm_limit: 10, // 默认每分钟 10 次（与普通添加一致；用户可在面板调整）
             email: req.email,
-            proxy_url: req.proxy_url,
+            proxy_url: proxy.as_ref().map(|value| value.url.clone()),
             ..Default::default()
         };
+        if let Some(binding) = &egress {
+            binding.apply_to_credential(&mut cred_template);
+        }
 
         let session = IdcAuthSession {
             region: req.region,
@@ -3261,6 +3528,7 @@ impl AdminService {
             cred_template,
             proxy,
             relogin_target_id: None,
+            egress: egress.clone(),
         };
 
         let poll_interval = session.poll_interval;
@@ -3273,6 +3541,13 @@ impl AdminService {
             verification_uri_complete: device.verification_uri_complete,
             expires_at: expires_at.to_rfc3339(),
             poll_interval,
+            session_nonce,
+            slot_id: egress.as_ref().map(|value| value.slot_id.clone()),
+            proxy_id: egress.as_ref().map(|value| value.proxy_id),
+            egress_fingerprint: egress.as_ref().map(|value| value.fingerprint.clone()),
+            browser_egress_status: egress
+                .as_ref()
+                .map(|value| value.browser_status.as_str().to_string()),
         })
     }
 
@@ -3280,7 +3555,16 @@ impl AdminService {
     pub async fn poll_idc_login(
         &self,
         session_id: &str,
+        session_nonce: Option<&str>,
     ) -> Result<PollIdcLoginResponse, AdminServiceError> {
+        let claimed = self.claim_idc_nonce(session_id, session_nonce)?;
+        if let Some((binding, proxy)) = &claimed {
+            if let Err(error) = self.verify_login_egress(binding, proxy.as_ref()).await {
+                self.idc_sessions.lock().remove(session_id);
+                return Err(error);
+            }
+        }
+
         let (
             region,
             client_id,
@@ -3290,6 +3574,7 @@ impl AdminService {
             proxy,
             cred_template,
             relogin_target_id,
+            egress,
         ) = {
             let sessions = self.idc_sessions.lock();
             let s = sessions
@@ -3309,6 +3594,7 @@ impl AdminService {
                 s.proxy.clone(),
                 s.cred_template.clone(),
                 s.relogin_target_id,
+                s.egress.clone(),
             )
         };
 
@@ -3324,12 +3610,19 @@ impl AdminService {
         )
         .await
         {
-            idc::PollResult::Pending => Ok(PollIdcLoginResponse::Pending),
+            idc::PollResult::Pending => Ok(PollIdcLoginResponse::Pending {
+                session_nonce: self.rotate_idc_nonce(session_id),
+            }),
             idc::PollResult::Expired => {
                 self.idc_sessions.lock().remove(session_id);
                 Ok(PollIdcLoginResponse::Expired)
             }
-            idc::PollResult::Error(e) => Err(AdminServiceError::InternalError(e.to_string())),
+            idc::PollResult::Error(e) => {
+                if egress.is_some() {
+                    self.idc_sessions.lock().remove(session_id);
+                }
+                Err(AdminServiceError::InternalError(e.to_string()))
+            }
             idc::PollResult::Success(token) => {
                 self.idc_sessions.lock().remove(session_id);
 
@@ -3353,14 +3646,16 @@ impl AdminService {
                     new_cred.expires_at = Some((Utc::now() + Duration::seconds(secs)).to_rfc3339());
                 }
 
-                let credential_id = self
-                    .token_manager
-                    .add_credential(new_cred)
-                    .await
-                    .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
+                let quarantined = egress.is_some();
+                let credential_id = if quarantined {
+                    self.token_manager.add_quarantined_credential(new_cred).await
+                } else {
+                    self.token_manager.add_credential(new_cred).await
+                }
+                .map_err(|e| AdminServiceError::InternalError(e.to_string()))?;
 
                 // 主动刷新余额（含订阅等级 / 邮箱）并写入缓存，登录后立即可见
-                if let Err(e) = self.get_balance(credential_id).await {
+                if !quarantined && let Err(e) = self.get_balance(credential_id).await {
                     tracing::warn!("IdC 登录后刷新余额失败（不影响登录）: {}", e);
                 }
 
@@ -3458,6 +3753,7 @@ impl AdminService {
             proxy,
             _server_handle: server_handle,
             relogin_target_id: Some(target_id),
+            egress: None,
         };
 
         self.social_sessions
@@ -3468,6 +3764,11 @@ impl AdminService {
             session_id,
             portal_url,
             expires_at: expires_at.to_rfc3339(),
+            session_nonce: None,
+            slot_id: None,
+            proxy_id: None,
+            egress_fingerprint: None,
+            browser_egress_status: None,
         })
     }
 
@@ -3524,6 +3825,7 @@ impl AdminService {
             cred_template: KiroCredentials::default(),
             proxy,
             relogin_target_id: Some(target_id),
+            egress: None,
         };
 
         let poll_interval = session.poll_interval;
@@ -3536,6 +3838,11 @@ impl AdminService {
             verification_uri_complete: device.verification_uri_complete,
             expires_at: expires_at.to_rfc3339(),
             poll_interval,
+            session_nonce: None,
+            slot_id: None,
+            proxy_id: None,
+            egress_fingerprint: None,
+            browser_egress_status: None,
         })
     }
 }
diff --git a/src/admin/types.rs b/src/admin/types.rs
index 35535297..001c5a84 100644
--- a/src/admin/types.rs
+++ b/src/admin/types.rs
@@ -921,6 +921,12 @@ pub struct UpdateClientKeyRequest {
 
 // ============ IdC 设备授权登录 ============
 
+#[derive(Debug, Serialize)]
+#[serde(rename_all = "camelCase")]
+pub struct EgressLoginCapabilityResponse {
+    pub enabled: bool,
+}
+
 /// 发起 IdC 设备授权请求
 #[derive(Debug, Deserialize)]
 #[serde(rename_all = "camelCase")]
@@ -934,6 +940,13 @@ pub struct StartIdcLoginRequest {
     pub email: Option<String>,
     #[serde(default)]
     pub proxy_url: Option<String>,
+    /// Egress login v2 uses a managed proxy-pool ID instead of an arbitrary URL.
+    #[serde(default)]
+    pub proxy_id: Option<u64>,
+    /// Optional browser-observed public IP. It is compared in memory and is
+    /// never persisted or logged.
+    #[serde(default)]
+    pub browser_egress_ip: Option<String>,
 }
 
 /// 发起 IdC 设备授权响应
@@ -947,6 +960,16 @@ pub struct StartIdcLoginResponse {
     pub verification_uri_complete: Option<String>,
     pub expires_at: String,
     pub poll_interval: i64,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_nonce: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub slot_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy_id: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub egress_fingerprint: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub browser_egress_status: Option<String>,
 }
 
 /// 轮询 IdC 登录状态响应
@@ -960,9 +983,16 @@ pub struct StartIdcLoginResponse {
 #[serde(rename_all = "camelCase", rename_all_fields = "camelCase", tag = "status")]
 pub enum PollIdcLoginResponse {
     #[serde(rename = "pending")]
-    Pending,
+    Pending {
+        #[serde(skip_serializing_if = "Option::is_none")]
+        session_nonce: Option<String>,
+    },
     #[serde(rename = "continue")]
-    Continue { next_url: String },
+    Continue {
+        next_url: String,
+        #[serde(skip_serializing_if = "Option::is_none")]
+        session_nonce: Option<String>,
+    },
     #[serde(rename = "success")]
     Success { credential_id: u64 },
     #[serde(rename = "expired")]
@@ -987,6 +1017,10 @@ pub struct StartSocialLoginRequest {
     /// Kiro auth endpoint（留空用默认）
     #[serde(default)]
     pub auth_endpoint: Option<String>,
+    #[serde(default)]
+    pub proxy_id: Option<u64>,
+    #[serde(default)]
+    pub browser_egress_ip: Option<String>,
 }
 
 /// 发起 Social 登录响应
@@ -999,6 +1033,16 @@ pub struct StartSocialLoginResponse {
     pub portal_url: String,
     /// 会话过期时间（RFC3339）
     pub expires_at: String,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub session_nonce: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub slot_id: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub proxy_id: Option<u64>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub egress_fingerprint: Option<String>,
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub browser_egress_status: Option<String>,
 }
 
 /// 手动完成 Social 登录请求（远程访问场景：从浏览器地址栏复制回调 URL）
@@ -1279,10 +1323,12 @@ mod tests {
 
         let cont = serde_json::to_value(PollIdcLoginResponse::Continue {
             next_url: "https://example.com/next".to_string(),
+            session_nonce: Some("rotated".to_string()),
         })
         .unwrap();
         assert_eq!(cont["status"], "continue");
         assert_eq!(cont["nextUrl"], "https://example.com/next");
+        assert_eq!(cont["sessionNonce"], "rotated");
         assert!(cont.get("next_url").is_none());
     }
 
diff --git a/src/kiro/egress_login.rs b/src/kiro/egress_login.rs
new file mode 100644
index 00000000..792e2586
--- /dev/null
+++ b/src/kiro/egress_login.rs
@@ -0,0 +1,174 @@
+//! Egress-bound login primitives used by dormant Gate B.
+
+use std::net::IpAddr;
+
+use anyhow::Context;
+use sha2::{Digest, Sha256};
+
+use crate::http_client::{ProxyConfig, build_client};
+use crate::kiro::model::credentials::KiroCredentials;
+use crate::model::config::{Config, TlsBackend};
+
+const DEFAULT_EGRESS_PROBE_URL: &str = "https://checkip.amazonaws.com";
+
+#[derive(Debug, Clone, Copy, PartialEq, Eq)]
+pub enum BrowserEgressStatus {
+    Verified,
+    Unverified,
+}
+
+impl BrowserEgressStatus {
+    pub fn as_str(self) -> &'static str {
+        match self {
+            Self::Verified => "verified",
+            Self::Unverified => "unverified",
+        }
+    }
+}
+
+#[derive(Debug, Clone)]
+pub struct EgressProbe {
+    pub fingerprint: String,
+    pub proxy_version: String,
+    pub browser_status: BrowserEgressStatus,
+}
+
+pub fn enabled() -> bool {
+    std::env::var("KIRO_EGRESS_LOGIN_V2_ENABLED")
+        .map(|value| flag_value_enabled(&value))
+        .unwrap_or(false)
+}
+
+fn flag_value_enabled(value: &str) -> bool {
+    value.trim().eq_ignore_ascii_case("true")
+}
+
+pub fn sha256_hex(value: impl AsRef<[u8]>) -> String {
+    let mut hasher = Sha256::new();
+    hasher.update(value.as_ref());
+    hex::encode(hasher.finalize())
+}
+
+pub fn proxy_version(proxy_id: u64, proxy_url: &str) -> String {
+    sha256_hex(format!("v1\0{proxy_id}\0{}", proxy_url.trim()))
+}
+
+fn fingerprint(proxy_id: u64, version: &str, ip: IpAddr) -> String {
+    sha256_hex(format!("v1\0{proxy_id}\0{version}\0{ip}"))
+}
+
+pub fn verify_nonce(expected_hash: &str, supplied: Option<&str>) -> anyhow::Result<()> {
+    let supplied = supplied
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .ok_or_else(|| anyhow::anyhow!("缺少 egress login session nonce"))?;
+    if sha256_hex(supplied) != expected_hash {
+        anyhow::bail!("egress login session nonce 无效或已被轮换");
+    }
+    Ok(())
+}
+
+pub fn new_nonce() -> (String, String) {
+    let raw = uuid::Uuid::new_v4().to_string();
+    let hash = sha256_hex(&raw);
+    (raw, hash)
+}
+
+pub async fn probe(
+    proxy_id: u64,
+    proxy: &ProxyConfig,
+    browser_ip: Option<&str>,
+    tls_backend: TlsBackend,
+) -> anyhow::Result<EgressProbe> {
+    if proxy.url.trim().is_empty() || ProxyConfig::is_direct(&proxy.url) {
+        anyhow::bail!("egress login v2 要求显式托管代理，不能使用 direct");
+    }
+    let version = proxy_version(proxy_id, &proxy.url);
+    let probe_url = std::env::var("KIRO_EGRESS_PROBE_URL")
+        .ok()
+        .filter(|value| !value.trim().is_empty())
+        .unwrap_or_else(|| DEFAULT_EGRESS_PROBE_URL.to_string());
+    let client = build_client(Some(proxy), 10, tls_backend)?;
+    let response = client
+        .get(probe_url)
+        .send()
+        .await
+        .context("egress probe 请求失败")?;
+    if !response.status().is_success() {
+        anyhow::bail!("egress probe 返回 HTTP {}", response.status());
+    }
+    let public_ip: IpAddr = response
+        .text()
+        .await
+        .context("读取 egress probe 响应失败")?
+        .trim()
+        .parse()
+        .context("egress probe 未返回合法 IP")?;
+    let browser_status = match browser_ip.map(str::trim).filter(|value| !value.is_empty()) {
+        Some(value) => {
+            let browser_ip: IpAddr = value.parse().context("browser egress IP 格式无效")?;
+            if browser_ip != public_ip {
+                anyhow::bail!("browser egress 与授权代理出口不一致");
+            }
+            BrowserEgressStatus::Verified
+        }
+        None => BrowserEgressStatus::Unverified,
+    };
+    Ok(EgressProbe {
+        fingerprint: fingerprint(proxy_id, &version, public_ip),
+        proxy_version: version,
+        browser_status,
+    })
+}
+
+pub async fn verify_bound_credential(
+    credentials: &KiroCredentials,
+    config: &Config,
+    proxy: Option<&ProxyConfig>,
+) -> anyhow::Result<()> {
+    let Some(expected_fingerprint) = credentials.egress_fingerprint.as_deref() else {
+        return Ok(());
+    };
+    let proxy_id = credentials
+        .egress_proxy_id
+        .ok_or_else(|| anyhow::anyhow!("egress-bound 凭据缺少 proxy id"))?;
+    let proxy = proxy.ok_or_else(|| anyhow::anyhow!("egress-bound 凭据缺少有效代理"))?;
+    let observed = probe(proxy_id, proxy, None, config.tls_backend).await?;
+    if credentials.egress_proxy_version.as_deref() != Some(observed.proxy_version.as_str()) {
+        anyhow::bail!("egress-bound 凭据代理版本发生漂移");
+    }
+    if expected_fingerprint != observed.fingerprint {
+        anyhow::bail!("egress-bound 凭据出口发生漂移");
+    }
+    Ok(())
+}
+
+#[cfg(test)]
+mod tests {
+    use super::*;
+
+    #[test]
+    fn feature_flag_fails_closed() {
+        assert!(!flag_value_enabled(""));
+        assert!(!flag_value_enabled("invalid"));
+        assert!(!flag_value_enabled("1"));
+        assert!(flag_value_enabled(" TRUE "));
+    }
+
+    #[test]
+    fn nonce_is_hashed_and_stale_value_is_rejected() {
+        let (raw, hash) = new_nonce();
+        assert_ne!(raw, hash);
+        assert!(verify_nonce(&hash, Some(&raw)).is_ok());
+        assert!(verify_nonce(&hash, Some("stale")).is_err());
+        assert!(verify_nonce(&hash, None).is_err());
+    }
+
+    #[test]
+    fn proxy_version_is_bound_to_id_and_url() {
+        let first = proxy_version(7, "socks5://127.0.0.1:1080");
+        assert_eq!(first, proxy_version(7, "socks5://127.0.0.1:1080"));
+        assert_ne!(first, proxy_version(8, "socks5://127.0.0.1:1080"));
+        assert_ne!(first, proxy_version(7, "socks5://127.0.0.1:1081"));
+    }
+}
diff --git a/src/kiro/mod.rs b/src/kiro/mod.rs
index 35859baf..44fdbe5a 100644
--- a/src/kiro/mod.rs
+++ b/src/kiro/mod.rs
@@ -2,6 +2,7 @@
 
 pub mod auth;
 pub mod endpoint;
+pub mod egress_login;
 pub mod error;
 pub mod kiro_version;
 pub mod machine_id;
diff --git a/src/kiro/model/credentials.rs b/src/kiro/model/credentials.rs
index e692153b..665b2998 100644
--- a/src/kiro/model/credentials.rs
+++ b/src/kiro/model/credentials.rs
@@ -163,6 +163,18 @@ pub struct KiroCredentials {
     #[serde(default)]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub source_channel: Option<String>,
+
+    /// Egress-bound login v2 reservation metadata. These values contain only
+    /// hashes and internal IDs; raw public IPs and proxy credentials are never
+    /// persisted here.
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub login_slot_id: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub egress_proxy_id: Option<u64>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub egress_proxy_version: Option<String>,
+    #[serde(default, skip_serializing_if = "Option::is_none")]
+    pub egress_fingerprint: Option<String>,
 }
 
 /// 判断是否为零（用于跳过序列化）
@@ -217,6 +229,10 @@ impl std::fmt::Debug for KiroCredentials {
             .field("endpoint", &self.endpoint)
             .field("groups", &self.groups)
             .field("source_channel", &self.source_channel)
+            .field("login_slot_id", &self.login_slot_id)
+            .field("egress_proxy_id", &self.egress_proxy_id)
+            .field("egress_proxy_version", &self.egress_proxy_version)
+            .field("egress_fingerprint", &self.egress_fingerprint)
             .finish()
     }
 }
@@ -930,6 +946,10 @@ mod tests {
             endpoint: None,
             groups: vec![],
             source_channel: None,
+            login_slot_id: None,
+            egress_proxy_id: None,
+            egress_proxy_version: None,
+            egress_fingerprint: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1170,6 +1190,10 @@ mod tests {
             endpoint: None,
             groups: vec![],
             source_channel: None,
+            login_slot_id: None,
+            egress_proxy_id: None,
+            egress_proxy_version: None,
+            egress_fingerprint: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1209,6 +1233,10 @@ mod tests {
             endpoint: None,
             groups: vec![],
             source_channel: None,
+            login_slot_id: None,
+            egress_proxy_id: None,
+            egress_proxy_version: None,
+            egress_fingerprint: None,
         };
 
         let json = creds.to_pretty_json().unwrap();
@@ -1331,6 +1359,10 @@ mod tests {
             endpoint: None,
             groups: vec![],
             source_channel: None,
+            login_slot_id: None,
+            egress_proxy_id: None,
+            egress_proxy_version: None,
+            egress_fingerprint: None,
         };
 
         let json = original.to_pretty_json().unwrap();
diff --git a/src/kiro/token_manager.rs b/src/kiro/token_manager.rs
index 98ef22f5..f50cf64c 100644
--- a/src/kiro/token_manager.rs
+++ b/src/kiro/token_manager.rs
@@ -121,6 +121,8 @@ pub(crate) async fn refresh_token(
         bail!("API Key 凭据不支持刷新 Token");
     }
 
+    crate::kiro::egress_login::verify_bound_credential(credentials, config, proxy).await?;
+
     validate_refresh_token(credentials)?;
 
     // 企业 SSO (external_idp) 走 IdP token 端点刷新（refresh_token grant，public client），
@@ -3687,6 +3689,23 @@ impl MultiTokenManager {
     /// - `Ok(u64)` - 新凭据 ID
     /// - `Err(_)` - 验证失败或添加失败
     pub async fn add_credential(&self, new_cred: KiroCredentials) -> anyhow::Result<u64> {
+        self.add_credential_with_state(new_cred, false).await
+    }
+
+    /// Add a credential after validation but keep it out of scheduling until
+    /// an explicit promote action enables it.
+    pub async fn add_quarantined_credential(
+        &self,
+        new_cred: KiroCredentials,
+    ) -> anyhow::Result<u64> {
+        self.add_credential_with_state(new_cred, true).await
+    }
+
+    async fn add_credential_with_state(
+        &self,
+        new_cred: KiroCredentials,
+        quarantined: bool,
+    ) -> anyhow::Result<u64> {
         // 1. 基本验证
         if new_cred.is_api_key_credential() {
             let api_key = new_cred
@@ -3799,6 +3818,13 @@ impl MultiTokenManager {
         validated_cred.proxy_username = new_cred.proxy_username;
         validated_cred.proxy_password = new_cred.proxy_password;
         validated_cred.kiro_api_key = new_cred.kiro_api_key;
+        validated_cred.groups = new_cred.groups;
+        validated_cred.source_channel = new_cred.source_channel;
+        validated_cred.login_slot_id = new_cred.login_slot_id;
+        validated_cred.egress_proxy_id = new_cred.egress_proxy_id;
+        validated_cred.egress_proxy_version = new_cred.egress_proxy_version;
+        validated_cred.egress_fingerprint = new_cred.egress_fingerprint;
+        validated_cred.disabled = quarantined;
 
         {
             let mut entries = self.entries.lock();
@@ -3854,8 +3880,8 @@ impl MultiTokenManager {
                 failure_count: 0,
                 total_failure_count: 0,
                 refresh_failure_count: 0,
-                disabled: false,
-                disabled_reason: None,
+                disabled: quarantined,
+                disabled_reason: quarantined.then_some(DisabledReason::Manual),
                 success_count: baseline_success,
                 last_used_at: None,
                 throttled_until: None,

From 3561be04e3dabe2374409f3f09e7f7ebfcbc1cc8 Mon Sep 17 00:00:00 2001
From: LZHS <lzhs@LZHSdeMacBook-Pro-5.local>
Date: Thu, 30 Jul 2026 08:42:10 +0530
Subject: [PATCH 2/3] fix(anthropic): forward structured output contract

---
 src/anthropic/converter.rs | 76 ++++++++++++++++++++++++++++++++++----
 src/anthropic/stream.rs    | 42 +++++++++++++++++++++
 2 files changed, 110 insertions(+), 8 deletions(-)

diff --git a/src/anthropic/converter.rs b/src/anthropic/converter.rs
index 75168724..3286d2bc 100644
--- a/src/anthropic/converter.rs
+++ b/src/anthropic/converter.rs
@@ -860,14 +860,30 @@ pub fn convert_request_with_mode(
         context = context.with_tool_results(validated_tool_results);
     }
 
+    let structured_output_schema = req
+        .output_config
+        .as_ref()
+        .and_then(|config| config.format.as_ref())
+        .filter(|format| format.format_type == "json_schema")
+        .map(|format| format.schema.clone());
+
     // 12. 构建当前消息
-    // 保留文本内容，即使有工具结果也不丢弃用户文本
+    // 保留文本内容，即使有工具结果也不丢弃用户文本。
+    // Kiro 没有原生 structured-output wire field，因此必须把契约显式交给模型；
+    // 响应端仍会做严格 JSON 解析和 schema 校验，提示词不是信任边界。
     let mut content = text_content;
     if req.tools.as_ref().is_some_and(|tools| !tools.is_empty()) {
         content.push_str(
             "\n\n[Tool compatibility: when an action requires a declared tool, emit the structured tool call. Do not end the turn with progress narration such as \"Searching\" or \"I will run it\".]",
         );
     }
+    if let Some(schema) = &structured_output_schema {
+        content.push_str(
+            "\n\n[Structured output contract: return exactly one JSON value matching the JSON Schema below. Do not include prose or Markdown fences. JSON Schema: ",
+        );
+        content.push_str(&schema.to_string());
+        content.push(']');
+    }
 
     let mut user_input = UserInputMessage::new(content, &model_id)
         .with_context(context)
@@ -918,13 +934,6 @@ pub fn convert_request_with_mode(
                 .collect()
         })
         .unwrap_or_default();
-    let structured_output_schema = req
-        .output_config
-        .as_ref()
-        .and_then(|config| config.format.as_ref())
-        .filter(|format| format.format_type == "json_schema")
-        .map(|format| format.schema.clone());
-
     Ok(ConversionResult {
         conversation_state,
         tool_name_map,
@@ -2496,6 +2505,57 @@ mod tests {
         req
     }
 
+    #[test]
+    fn structured_output_contract_is_forwarded_to_kiro_and_retained_for_validation() {
+        use super::super::types::{OutputConfig, StructuredOutputFormat};
+
+        let schema = serde_json::json!({
+            "type": "object",
+            "required": ["ok"],
+            "additionalProperties": false,
+            "properties": { "ok": { "type": "boolean" } }
+        });
+        let mut req = minimal_request_with_output_config("claude-opus-4-8");
+        req.output_config = Some(OutputConfig {
+            effort: "high".to_string(),
+            format: Some(StructuredOutputFormat {
+                format_type: "json_schema".to_string(),
+                schema: schema.clone(),
+            }),
+        });
+
+        let result = convert_request(&req).expect("structured output request should convert");
+        let content = &result
+            .conversation_state
+            .current_message
+            .user_input_message
+            .content;
+        let expected_suffix = format!(
+            "[Structured output contract: return exactly one JSON value matching the JSON Schema below. Do not include prose or Markdown fences. JSON Schema: {}]",
+            schema
+        );
+
+        assert_eq!(result.structured_output_schema, Some(schema));
+        assert!(content.starts_with("test\n\n"));
+        assert!(content.ends_with(&expected_suffix));
+    }
+
+    #[test]
+    fn requests_without_structured_output_keep_original_content() {
+        let req = minimal_request_with_output_config("claude-opus-4-8");
+        let result = convert_request(&req).expect("plain request should convert");
+
+        assert_eq!(result.structured_output_schema, None);
+        assert_eq!(
+            result
+                .conversation_state
+                .current_message
+                .user_input_message
+                .content,
+            "test"
+        );
+    }
+
     #[test]
     fn test_output_config_does_not_emit_unsupported_additional_fields() {
         let req = minimal_request_with_output_config("claude-sonnet-4-8-thinking");
diff --git a/src/anthropic/stream.rs b/src/anthropic/stream.rs
index 27617876..de40eee9 100644
--- a/src/anthropic/stream.rs
+++ b/src/anthropic/stream.rs
@@ -6305,6 +6305,48 @@ mod tests {
         assert!(!retry.should_retry_compatibility(1));
     }
 
+    #[test]
+    fn structured_json_second_compatibility_failure_is_terminal() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "required": ["ok"],
+            "additionalProperties": false,
+            "properties": { "ok": { "type": "boolean" } }
+        });
+        let mut first = BufferedStreamContext::new(
+            "test-model",
+            10,
+            false,
+            HashMap::new(),
+            std::collections::HashSet::new(),
+        );
+        first.set_structured_output_schema(Some(schema));
+        first.process_and_buffer(&assistant_response("not valid JSON"));
+        let mut retry = first.fresh_for_compatibility_retry();
+
+        let first_events = first.finish_and_get_all_events();
+        assert!(first.should_retry_compatibility(0));
+        assert!(!has_normal_completion(&first_events));
+
+        retry.process_and_buffer(&assistant_response("still not valid JSON"));
+        let retry_events = retry.finish_and_get_all_events();
+
+        assert!(!retry.should_retry_compatibility(1));
+        assert!(!has_normal_completion(&retry_events));
+        assert_eq!(
+            retry_events
+                .iter()
+                .filter(|event| event.event == "error")
+                .count(),
+            1
+        );
+        assert!(retry_events.iter().any(|event| {
+            event.data["error"]["message"]
+                .as_str()
+                .is_some_and(|message| message.contains("kiro_structured_json_parse_failed"))
+        }));
+    }
+
     #[test]
     fn second_compatibility_failure_never_emits_message_stop() {
         let mut first = buffered_tool_compatibility_context();

From bdf91c19d3c892932bf0dea94b818ce34b051c2a Mon Sep 17 00:00:00 2001
From: LZHS <lzhs@LZHSdeMacBook-Pro-5.local>
Date: Thu, 30 Jul 2026 10:00:12 +0530
Subject: [PATCH 3/3] fix(anthropic): flush thinking text before structured
 validation

---
 src/anthropic/handlers.rs |  34 ++++++++++++
 src/anthropic/stream.rs   | 111 +++++++++++++++++++++++++++++++++++++-
 2 files changed, 143 insertions(+), 2 deletions(-)

diff --git a/src/anthropic/handlers.rs b/src/anthropic/handlers.rs
index 2f2ad7e1..0ec9cac3 100644
--- a/src/anthropic/handlers.rs
+++ b/src/anthropic/handlers.rs
@@ -2736,6 +2736,40 @@ mod tests {
         assert_eq!(content[0]["text"], "native thinking fallback");
     }
 
+    #[test]
+    fn non_stream_structured_json_stays_canonical_with_native_thinking() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "required": ["ok"],
+            "additionalProperties": false,
+            "properties": { "ok": { "type": "boolean" } }
+        });
+        let canonical = super::super::stream::canonicalize_structured_json(
+            "```json\n{ \"ok\": true }\n```",
+            &schema,
+        )
+        .expect("valid structured output should canonicalize");
+
+        let ordinary =
+            build_non_stream_content(false, canonical.clone(), String::new(), None, Vec::new());
+        assert_eq!(
+            ordinary,
+            vec![json!({"type":"text","text":"{\"ok\":true}"})]
+        );
+
+        let thinking = build_non_stream_content(
+            true,
+            canonical,
+            "native reasoning".to_string(),
+            Some("real-signature".to_string()),
+            Vec::new(),
+        );
+        assert_eq!(thinking.len(), 2);
+        assert_eq!(thinking[0]["type"], "thinking");
+        assert_eq!(thinking[0]["thinking"], "native reasoning");
+        assert_eq!(thinking[1], json!({"type":"text","text":"{\"ok\":true}"}));
+    }
+
     #[test]
     fn available_models_include_opus_4_7_variants() {
         let models = static_available_models();
diff --git a/src/anthropic/stream.rs b/src/anthropic/stream.rs
index de40eee9..4850bd5c 100644
--- a/src/anthropic/stream.rs
+++ b/src/anthropic/stream.rs
@@ -2806,8 +2806,14 @@ impl StreamContext {
         events
     }
 
-    /// 生成最终事件序列
-    pub fn generate_final_events(&mut self) -> Vec<SseEvent> {
+    /// Flush every complete assistant-content fragment that is still held by
+    /// the streaming parsers, without emitting message completion events.
+    ///
+    /// Buffered structured-output responses must call this before inspecting
+    /// text deltas. Thinking mode intentionally keeps a short suffix while it
+    /// waits for a possibly split `<thinking>` tag, so validating before this
+    /// flush observes an empty or truncated JSON value.
+    fn flush_pending_content_events(&mut self) -> Vec<SseEvent> {
         let mut events = Vec::new();
 
         // 收尾：flush <tool_use> XML 过滤器的残留（截断的未闭合块会被丢弃），
@@ -2908,6 +2914,13 @@ impl StreamContext {
             events.extend(self.drain_invoke_sniff_buffer(true));
         }
 
+        events
+    }
+
+    /// 生成最终事件序列
+    pub fn generate_final_events(&mut self) -> Vec<SseEvent> {
+        let mut events = self.flush_pending_content_events();
+
         // 收尾检查工具调用累积器：若仍有 tool_use 从未收到 stop=true（上游在参数
         // 写到一半时截断），记为错误。process_tool_use 中已置位的错误保持不变。
         if self.tool_json_error.is_none() {
@@ -3085,6 +3098,13 @@ impl BufferedStreamContext {
             self.initial_events_generated = true;
         }
 
+        // Thinking and invoke parsing can retain a complete short assistant
+        // suffix until EOF. Materialize it before reading buffered text for
+        // strict JSON/schema validation; protocol completion still happens
+        // only after validation succeeds.
+        let pending_events = self.inner.flush_pending_content_events();
+        self.event_buffer.extend(pending_events);
+
         if let Some(schema) = &self.structured_output_schema {
             let text = self.buffered_text();
             match canonicalize_structured_json(&text, schema) {
@@ -6305,6 +6325,93 @@ mod tests {
         assert!(!retry.should_retry_compatibility(1));
     }
 
+    #[test]
+    fn thinking_structured_json_flushes_pending_text_before_validation() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "required": ["ok"],
+            "additionalProperties": false,
+            "properties": { "ok": { "type": "boolean" } }
+        });
+        let mut ctx = BufferedStreamContext::new(
+            "claude-opus-5-thinking",
+            10,
+            true,
+            HashMap::new(),
+            std::collections::HashSet::new(),
+        );
+        ctx.set_structured_output_schema(Some(schema));
+
+        ctx.process_and_buffer(&Event::ReasoningContent(
+            crate::kiro::model::events::ReasoningContentEvent {
+                text: Some("native reasoning".to_string()),
+                signature: Some("real-signature".to_string()),
+                redacted_content: None,
+            },
+        ));
+        // After native reasoning, thinking mode still keeps a short assistant
+        // suffix buffered while checking for a split legacy <thinking> tag.
+        ctx.process_and_buffer(&assistant_response("{\"ok\":true}"));
+        ctx.process_and_buffer(&metadata_stop("end_turn"));
+        let events = ctx.finish_and_get_all_events();
+        let text: String = events
+            .iter()
+            .filter(|event| {
+                event.event == "content_block_delta" && event.data["delta"]["type"] == "text_delta"
+            })
+            .filter_map(|event| event.data["delta"]["text"].as_str())
+            .collect();
+
+        assert_eq!(text, "{\"ok\":true}");
+        assert!(events.iter().any(|event| {
+            event.event == "content_block_delta"
+                && event.data["delta"]["type"] == "thinking_delta"
+                && event.data["delta"]["thinking"] == "native reasoning"
+        }));
+        assert!(events.iter().any(|event| event.event == "message_stop"));
+        assert!(!events.iter().any(|event| event.event == "error"));
+        assert!(!ctx.should_retry_compatibility(0));
+    }
+
+    #[test]
+    fn thinking_structured_json_keeps_one_retry_and_terminal_second_failure() {
+        let schema = serde_json::json!({
+            "type": "object",
+            "required": ["ok"],
+            "additionalProperties": false,
+            "properties": { "ok": { "type": "boolean" } }
+        });
+        let mut first = BufferedStreamContext::new(
+            "claude-opus-5-thinking",
+            10,
+            true,
+            HashMap::new(),
+            std::collections::HashSet::new(),
+        );
+        first.set_structured_output_schema(Some(schema));
+        first.process_and_buffer(&assistant_response("not valid JSON"));
+        first.process_and_buffer(&metadata_stop("end_turn"));
+        let mut retry = first.fresh_for_compatibility_retry();
+
+        let first_events = first.finish_and_get_all_events();
+        assert!(!has_normal_completion(&first_events));
+        assert!(first.should_retry_compatibility(0));
+
+        retry.process_and_buffer(&assistant_response("still not valid JSON"));
+        retry.process_and_buffer(&metadata_stop("end_turn"));
+        let retry_events = retry.finish_and_get_all_events();
+
+        assert!(!retry.should_retry_compatibility(1));
+        assert!(!has_normal_completion(&retry_events));
+        assert_eq!(
+            retry_events
+                .iter()
+                .filter(|event| event.event == "error")
+                .count(),
+            1
+        );
+    }
+
     #[test]
     fn structured_json_second_compatibility_failure_is_terminal() {
         let schema = serde_json::json!({