fix: exclude management paths from request history

gateway.mjs

@@ -3581,6 +3581,7 @@ function buildEditableConfig(currentConfig, payload) {
 
 async function handleManagementRequest(runtime, req, res, requestUrl) {
   const pathname = normalizePath(requestUrl.pathname);
+  const isManagementPath = pathname === ADMIN_BASE_PATH || pathname.startsWith(`${ADMIN_BASE_PATH}/`);
   const accessEnabled = managementAccessEnabled(runtime.config);
   const accessGranted = hasManagementAccess(req, requestUrl, runtime.config);
 
@@ -3628,7 +3629,7 @@ async function handleManagementRequest(runtime, req, res, requestUrl) {
     return true;
   }
 
-  if (accessEnabled && !accessGranted && pathname.startsWith(`${ADMIN_BASE_PATH}/`)) {
+  if (accessEnabled && !accessGranted && isManagementPath) {
     jsonResponse(req, res, 401, managementUnauthorizedPayload(), {
       "cache-control": "no-store",
       "set-cookie": clearManagementAccessCookieHeaders(),
@@ -4073,6 +4074,16 @@ async function handleManagementRequest(runtime, req, res, requestUrl) {
     return true;
   }
 
+  if (isManagementPath) {
+    jsonResponse(req, res, 404, {
+      error: {
+        message: "管理面路径不存在",
+        code: "management_endpoint_not_found",
+      },
+    });
+    return true;
+  }
+
   return false;
 }
 

scripts/test-gateway-e2e.mjs

@@ -659,6 +659,35 @@ async function run() {
       "status API 未暴露 management_access_key_configured",
     );
 
+    const requestsBeforeUnknownManagementResponse = await fetch(
+      `http://127.0.0.1:${gatewayPort}/__codex_retry_gateway/api/requests?limit=1`,
+      { headers: adminHeaders },
+    );
+    assert(
+      requestsBeforeUnknownManagementResponse.status === 200,
+      `未知管理路径检查前读取请求历史失败: ${requestsBeforeUnknownManagementResponse.status}`,
+    );
+    const requestsBeforeUnknownManagement = await requestsBeforeUnknownManagementResponse.json();
+    const unknownManagementResponse = await fetch(
+      `http://127.0.0.1:${gatewayPort}/__codex_retry_gateway/api/unknown-endpoint`,
+      { headers: adminHeaders },
+    );
+    assert(unknownManagementResponse.status === 404, `未知管理路径应返回 404: ${unknownManagementResponse.status}`);
+    const unknownManagementPayload = await unknownManagementResponse.json();
+    assert(
+      unknownManagementPayload?.error?.code === "management_endpoint_not_found",
+      "未知管理路径未返回管理面 404 标识",
+    );
+    const requestsAfterUnknownManagementResponse = await fetch(
+      `http://127.0.0.1:${gatewayPort}/__codex_retry_gateway/api/requests?limit=1`,
+      { headers: adminHeaders },
+    );
+    const requestsAfterUnknownManagement = await requestsAfterUnknownManagementResponse.json();
+    assert(
+      requestsAfterUnknownManagement.total_entries === requestsBeforeUnknownManagement.total_entries,
+      "未知管理路径不应计入请求历史",
+    );
+
     const migratedImageProfilesResponse = await fetch(
       `http://127.0.0.1:${gatewayPort}/__codex_retry_gateway/api/image-profiles`,
       { headers: adminHeaders },