refactor: remove Image Studio, flatten account tools, drop fork-only dead symbols

.downstream/native-domains.md

@@ -1,7 +1,7 @@
 # Native domains
 
-Six first-party domains run inside the host: Codex runtime, model policy,
-system prompts, account tools, image tools and observability. Native pages
+Five first-party domains run inside the host: Codex runtime, model policy,
+system prompts, account tools and observability. Native pages
 retain the console theme (flat_theme_enabled), account fields and persisted task interactions.
 The official third-party plugin framework and its own configuration UI remain.
 
@@ -13,10 +13,9 @@ authentication and the existing step-up policy.
 | Interface | Contract |
 | --- | --- |
 | `GET/PUT /admin/settings/codex-runtime` | Codex request body compression switch (`request_zstd`; a missing key is on). |
-| `GET/PUT /admin/settings/image-tools` | Image Studio switch (`studio_enabled`; a missing key is off). |
 | `GET/PUT /admin/settings/observability` | Telemetry and native theme switches. |
 
-Each of the three is stored as one `settings` row holding a JSON object of
+Each of the two is stored as one `settings` row holding a JSON object of
 boolean switches; `GET` and `PUT` answer with the switches in the standard
 response envelope. A `PUT` body that is not a JSON object, or that carries any
 other key or a non-boolean value (including `null`), returns HTTP 400 and stores
@@ -36,14 +35,14 @@ saved Codex runtime configuration has no hash recorded by v0.2.11-codexrip.6,
 key. Starting one of those three releases once satisfies the first two
 conditions.
 
-Then, before native settings load and before Image Studio or the plugin manager
-starts, one transaction retires the other first-party plugin installations a
-database still holds:
+Then, before native settings load and before the plugin manager starts, one
+transaction retires the other first-party plugin installations a database still
+holds, except `codexrip.image-tools`, which it does not read or change:
 
 1. Validates the saved first-party capability scopes and decrypts configuration.
-2. Imports the effective image and observability switches only when their native
-   settings keys are absent. Existing keys are never overwritten. The retired
-   Cindy provider installation is disabled without importing its switches.
+2. Imports the effective observability switches only when the native settings
+   key is absent. An existing key is never overwritten. The retired Cindy
+   provider installation is disabled without importing its switches.
 3. Saves original installation/binding/bootstrap intent under
    `deplugin_retired_plugins`, disables the installations and their bindings,
    and marks their bootstrap records removed.
@@ -79,6 +78,24 @@ continues. Images at or before v0.2.11-codexrip.5 also need
 `sub2api_plugin_state` and `sub2api_plugin_leases` for their route code and
 require a database dump taken before migration 264.
 
+Migration 270 has no down path either. It drops the three Image Studio tables
+with the job history and the records of the stored image files and deletes the
+`image_tools_config` setting; the files under `<data dir>/image-studio` are not
+removed. An earlier image starts on such a database only with Image Studio off,
+which the missing setting leaves to `GATEWAY_IMAGE_STUDIO_ENABLED`: with that
+variable `true` it exits at start, and its Image Studio job routes fail on the
+dropped tables.
+
+Migration 271 has no down path. It drops `usage_billing_dedup.account_id`, which
+the billing claim no longer writes and nothing reads. An earlier image names
+that column in every billing claim, so its usage billing fails on such a
+database until the column is added again
+(`ALTER TABLE usage_billing_dedup ADD COLUMN account_id BIGINT`). Migration 271
+is already recorded by then and does not run a second time: after returning to
+this release or a later one, drop the column by hand
+(`ALTER TABLE usage_billing_dedup DROP COLUMN IF EXISTS account_id`). Billing
+works with the column present until that is done.
+
 Returning to a plugin-based host is not an image change. That host needs schema
 objects and plugin data the current database no longer holds, so it requires a
 database dump that still has them. Such a legacy-host rollback has not been run

.downstream/refresh-coverage.mjs

@@ -48,12 +48,12 @@ if (missing.length) {
 
 function ownerOf(file) {
   if (file.startsWith('plugins/')) return file.split('/')[1] === 'bundle.source.json' ? 'core-extension-and-job-host' : file.split('/')[1]
-  if (/\/plugin[^/]*\.(?:go|ts|vue)$|\/plugins\/|backend\/pkg\/(?:extensionapi|pluginapi)\/|internal\/testextensions\//.test(file)) return 'core-extension-and-job-host'
+  if (/\/plugin[^/]*\.(?:go|ts|vue)$|\/plugins\/|backend\/pkg\/(?:extensionapi|pluginapi)\//.test(file)) return 'core-extension-and-job-host'
   if (/^\.github\/|^Dockerfile|^deploy\/|^\.dockerignore$|^\.gitignore$|refresh-coverage\.mjs$/.test(file)) return 'operations'
   if (/remote_skill|business_system_prompt|systemPrompt|SystemPrompt/.test(file)) return 'prompt-skills'
   if (/^\.downstream\/|^\.superpowers\/|\.md$/.test(file)) return 'documentation-and-history'
   if (/cindy/i.test(file)) return 'cindy-provider'
-  if (/image_studio|ImageStudio|codex_image_generation_bridge/.test(file)) return 'image-tools'
+  if (/image_studio|codex_image_generation_bridge/.test(file)) return 'image-tools'
   if (/account_traffic_observe|styles\/theme\.css|tailwind\.config/.test(file)) return 'admin-observability'
   if (/account_quota|quota_estimate|quota_activity/.test(file)) return 'core-quota-and-protocol'
   return priorOwners.get(file) || 'mixed-requires-review'

.downstream/upstream-review-v0.2.13.md

@@ -98,7 +98,7 @@ Every official commit is adopted with its official behaviour. Where upstream and
   - the Codex models manifest selects through the scheduler as well, where upstream uses `SelectAccountForModelWithExclusions`, which installs no gate; its handler sets the suppress marker before the selection loop, so the manifest stays outside the gate as upstream (`TestCodexModelsIgnoresGroupProfitControl`);
   - the eligibility helpers return `(bool, reason)` for the downstream selection diagnostics, and the handlers pass the pricing instant through the downstream usage snapshot;
   - the auth snapshot version is the downstream counter (28; upstream 24).
-- Image Studio and the Responses image bridge stay off, the public model page stays retired and reasoning recovery stays a downstream addition (one global switch, see Integration decisions); no upstream change in this range touches them.
+- The public model page stays retired and reasoning recovery stays a downstream addition (one global switch, see Integration decisions); no upstream change in this range touches them.
 
 ## Conflict resolutions
 

.github/scripts/test_native_domains.sh

@@ -4,13 +4,12 @@ set -euo pipefail
 repo_root=$(cd -- "$(dirname -- "${BASH_SOURCE[0]}")/../.." && pwd)
 cd "$repo_root"
 
-# The same domain policies now compile into the host; no package/signing process.
+# The Codex runtime domain packages.
 go -C backend test -p=1 -tags unit \
-  ./internal/accounttools/... \
   ./internal/codexruntime/... \
   -count=1
 
 # Preserve configuration/storage boundaries without starting real IO.
 go -C backend test -p=1 -tags unit ./internal/service ./internal/repository \
-  -run '^(TestCodexRuntimeSettingIsOnePlainRowOverTheDeployDefault|TestPrepareOpenAICodexWireRequest.*|TestNativeCodexErrorDiagnosticsProjectEveryStoredAttempt|TestNativePluginBoundaryProtectsRetiredRecordsAndAllowsThirdParties|TestNativeFeatureBootstrapPreservesEffectiveConfiguration|TestNativeSettingLoadFailureNeverReenablesSavedSwitches|TestImageTools.*|TestSwitchingImageStudio(OnStartsTheRuntime|OffStopsDetachedUpstreamIO)|TestTrafficObservation.*|TestAccountTrafficOutcomeRulesKeepCancellationAboveErrorsAndRequireWSTerminals|TestDecodeSwitchSettingsRejectsUnknownAndNonBooleanValues)$' \
+  -run '^(TestCodexRuntimeSettingIsOnePlainRowOverTheDeployDefault|TestPrepareOpenAICodexWireRequest.*|TestNativeCodexErrorDiagnosticsProjectEveryStoredAttempt|TestNativePluginBoundaryProtectsRetiredRecordsAndAllowsThirdParties|TestNativeFeatureBootstrapPreservesEffectiveConfiguration|TestNativeSettingLoadFailureNeverReenablesSavedSwitches|TestTrafficObservation.*|TestAccountTrafficOutcomeRulesKeepCancellationAboveErrorsAndRequireWSTerminals|TestDecodeSwitchSettingsRejectsUnknownAndNonBooleanValues)$' \
   -count=1

.github/workflows/downstream-verify.yml

@@ -42,7 +42,7 @@ jobs:
         run: bash .github/scripts/test_model_context_capacity.sh
       - name: Service tests
         working-directory: backend
-        run: go test -p=1 -tags unit ./internal/service -run 'Test.*(Refusal|CyberPolicy|Continuation|InvalidEncryptedContent|PreviousResponseNotFound|CapacityShed|RequestScopedTransient|ServerOverloaded|AlphaSearch|SelectedWorkspace)|Test(UpdateService|NormalizeAccountTaxonomyName|FilterConsoleAccounts|AccountConsolePlan|AccountFacetMatcher)' -count=1
+        run: go test -p=1 -tags unit ./internal/service -run 'Test.*(Refusal|CyberPolicy|Continuation|InvalidEncryptedContent|PreviousResponseNotFound|CapacityShed|RequestScopedTransient|ServerOverloaded|AlphaSearch|SelectedWorkspace)|Test(UpdateService|NormalizeAccountTaxonomyName|AccountTaxonomyRules|AccountTestReasoningValidated|FilterConsoleAccounts|AccountConsolePlan|AccountFacetMatcher)' -count=1
       - name: Upstream automation classifier tests
         run: |
           python3 .github/scripts/test_upstream_risk.py
@@ -53,13 +53,10 @@ jobs:
       - name: Gateway management isolation race test
         working-directory: backend
         run: go test -race ./internal/handler -run '^TestOpenAIBlockedUpstreamsDoNotSerializeManagementPlane$' -count=1
-      - name: Native policy cancellation race test
-        working-directory: backend
-        run: go test -p=1 -race -tags unit ./internal/service -run '^TestNativePolicyCancellationSurvivesDetachedClientContext$' -count=1
       - name: Image, model list, and turn-state tests
         working-directory: backend
         run: |
-          go test -p=1 -tags unit ./internal/repository ./internal/service ./internal/handler ./internal/handler/admin -run 'Test.*(ImageStudioEligibleKeys|CodexImageGenerationBridgeOverridePrecedence|TurnStateCommits|SchedulerCache|SchedulerRefresh|GatewayModels|WriteOpenAIModelsList|AccountHandlerGetAvailableModels|ForwardResponsesOllamaClampPreservesContinuationPolicy|AccountAvailableModels|FetchOpenAIAccountModels|SetAnthropicAPIKeyAuthHeader|OllamaCloud.*(MaxTokens|MaxOutputTokens|Bearer)|Clamps.*OllamaBase)' -count=1
+          go test -p=1 -tags unit ./internal/repository ./internal/service ./internal/handler ./internal/handler/admin -run 'Test.*(CodexImageGenerationBridgeOverridePrecedence|TurnStateCommits|SchedulerCache|GatewayModels|WriteOpenAIModelsList|AccountHandlerGetAvailableModels|ForwardResponsesOllamaClampPreservesContinuationPolicy|AccountAvailableModels|FetchOpenAIAccountModels|SetAnthropicAPIKeyAuthHeader|OllamaCloud.*(MaxTokens|MaxOutputTokens|Bearer)|Clamps.*OllamaBase)' -count=1
           go test -p=1 -tags unit ./migrations -run 'Test.*(Migration222|Migration223|Migration224|Migration230|Migration231|Migration232|Migration235|Migration236|GroupModelAllowlistRepairMigration|ReleaseAcceptance)' -count=1
       - name: Request body recovery tests
         working-directory: backend
@@ -119,7 +116,6 @@ jobs:
             src/components/common/__tests__/VersionBadge.downstream.spec.ts \
             src/components/common/__tests__/BaseDialog.spec.ts \
             src/components/common/__tests__/Select.disabled.spec.ts \
-            src/utils/__tests__/imageStudioLocalResources.spec.ts \
             src/views/admin/__tests__/PluginsView.spec.ts \
             src/components/admin/codex/__tests__/CodexRuntime.native.spec.ts \
             src/api/__tests__/downstreamStatus.spec.ts \
@@ -129,7 +125,6 @@ jobs:
             src/components/admin/account-jobs/__tests__/AccountTaskDrawer.spec.ts \
             src/stores/__tests__/accountJobs.spec.ts \
             src/api/__tests__/accountOperationIdempotency.spec.ts \
-            src/features/image-studio/history.legacy.spec.ts \
             src/components/admin/account/__tests__/AccountFolderBar.spec.ts \
             src/components/admin/account/__tests__/AccountTaxonomyManager.spec.ts \
             src/components/admin/account/__tests__/AccountBulkTaxonomyModal.spec.ts \
@@ -157,11 +152,9 @@ jobs:
             src/views/admin/__tests__/AccountsView.console.spec.ts \
             src/utils/__tests__/accountKeySearch.spec.ts \
             src/views/admin/__tests__/AccountsView.priorityColumn.spec.ts \
-            src/features/image-studio/__tests__/api.spec.ts \
             src/components/layout/__tests__/AppSidebar.spec.ts \
             src/components/layout/__tests__/AppSidebar.simple-mode.spec.ts \
             src/views/admin/__tests__/GroupsView.columnSettings.spec.ts \
-            src/features/image-studio/__tests__/ImageStudioPage.spec.ts \
             src/views/admin/__tests__/AccountsView.bulkEdit.spec.ts \
             src/views/admin/__tests__/AccountsView.selectionScope.spec.ts \
             src/views/admin/__tests__/AccountsView.schedulerScore.spec.ts \

DOWNSTREAM.md

@@ -10,7 +10,7 @@ This fork maintains the `codexrip` patch set over official Sub2API releases.
 
 ## Native domains and account operations
 
-The seven first-party domains now run inside the host and use native Vue pages.
+The five first-party domains run inside the host and use native Vue pages.
 The official third-party plugin framework remains available. Domain settings,
 startup data preservation and the legacy-host rollback boundary are described in
 [native domains](.downstream/native-domains.md).
@@ -45,9 +45,8 @@ only that account/model. The account option `openai_prompt_cache_key_mode`
 64 characters with its SHA-256 hex. Continuation, refusal recovery and
 destination-specific reasoning summaries remain supported. Account test model
 choices persist; API-key reveal requires the configured password. The account test
-dialog keeps list position. Image Studio defaults off and lists no eligible key
-until a generic image model source exists. Public model management remains
-retired; catalog changes do not restore its routes or navigation.
+dialog keeps list position. Public model management remains retired; catalog
+changes do not restore its routes or navigation.
 
 Quota storage, aggregation, cleanup and resets follow official semantics. Missing
 quota rows represent unlimited access; rows with three NULL limits are purged by

backend/cmd/server/main.go

@@ -232,21 +232,6 @@ func runMainServer() {
 			os.Exit(1)
 		}
 	}
-	if app.ImageStudio != nil {
-		studio := app.ImageStudio
-		service.SetImageStudioStarter(func() {
-			if err := studio.Start(context.Background()); err != nil {
-				log.Printf("Image Studio could not start: %v", err)
-			}
-		})
-	}
-	if app.ImageStudio != nil && service.ImageStudioFeatureEnabled() {
-		if err := app.ImageStudio.Start(context.Background()); err != nil {
-			log.Printf("Image Studio could not start: %v", err)
-			app.Cleanup()
-			os.Exit(1)
-		}
-	}
 
 	// 启动服务器
 	go func() {

backend/cmd/server/wire.go

@@ -31,7 +31,6 @@ type Application struct {
 	PromptAudit   *securityaudit.PromptService
 	PluginManager *service.PluginManager
 	AccountJobs   *service.AccountJobRuntime
-	ImageStudio   *service.ImageStudioRuntime
 	CodexIdentity *service.CodexClientIdentityBackfillService
 	Cleanup       func()
 }
@@ -64,7 +63,7 @@ func initializeApplication(buildInfo handler.BuildInfo) (*Application, error) {
 		provideCleanup,
 
 		// Application struct
-		wire.Struct(new(Application), "Server", "PromptAudit", "PluginManager", "AccountJobs", "ImageStudio", "CodexIdentity", "Cleanup"),
+		wire.Struct(new(Application), "Server", "PromptAudit", "PluginManager", "AccountJobs", "CodexIdentity", "Cleanup"),
 	)
 	return nil, nil
 }
@@ -145,7 +144,6 @@ func provideCleanup(
 	openAIAutoReset *service.OpenAIQuotaAutoResetService,
 	promptAudit *securityaudit.PromptService,
 	accountJobs *service.AccountJobRuntime,
-	imageStudioRuntime *service.ImageStudioRuntime,
 	pluginManager *service.PluginManager,
 ) func() {
 	return func() {
@@ -158,12 +156,6 @@ func provideCleanup(
 
 		// 应用层清理步骤可并行执行，基础设施资源（Redis/Ent）最后按顺序关闭。
 		parallelSteps := []cleanupStep{
-			{"ImageStudioRuntime", func() error {
-				if imageStudioRuntime != nil {
-					return imageStudioRuntime.Stop(ctx)
-				}
-				return nil
-			}},
 			{"AccountJobRuntime", func() error {
 				if accountJobs != nil {
 					accountJobs.Stop()