feat: 新增全局错误透传规则功能

支持管理员配置上游错误如何返回给客户端：
- 新增 ErrorPassthroughRule 数据模型和 Ent Schema
- 实现规则的 CRUD API（/admin/error-passthrough-rules）
- 支持按错误码、关键词匹配，支持 any/all 匹配模式
- 支持按平台过滤（anthropic/openai/gemini/antigravity）
- 支持透传或自定义响应状态码和错误消息
- 实现两级缓存（Redis + 本地内存）和多实例同步
- 集成到 gateway_handler 的错误处理流程
- 新增前端管理界面组件
- 新增单元测试覆盖核心匹配逻辑

优化：
- 移除 refreshLocalCache 中的冗余排序（数据库已排序）
- 后端 Validate() 增加匹配条件非空校验

backend/internal/service/antigravity_gateway_service.go

@@ -1106,7 +1106,7 @@ func (s *AntigravityGatewayService) Forward(ctx context.Context, c *gin.Context,
 					Message:            upstreamMsg,
 					Detail:             upstreamDetail,
 				})
-				return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+				return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 			}
 
 			return nil, s.writeMappedClaudeError(c, account, resp.StatusCode, resp.Header.Get("x-request-id"), respBody)
@@ -1779,6 +1779,7 @@ func (s *AntigravityGatewayService) ForwardGemini(ctx context.Context, c *gin.Co
 	// 处理错误响应
 	if resp.StatusCode >= 400 {
 		respBody, _ := io.ReadAll(io.LimitReader(resp.Body, 2<<20))
+		contentType := resp.Header.Get("Content-Type")
 		// 尽早关闭原始响应体，释放连接；后续逻辑仍可能需要读取 body，因此用内存副本重新包装。
 		_ = resp.Body.Close()
 		resp.Body = io.NopCloser(bytes.NewReader(respBody))
@@ -1849,10 +1850,8 @@ func (s *AntigravityGatewayService) ForwardGemini(ctx context.Context, c *gin.Co
 				Message:            upstreamMsg,
 				Detail:             upstreamDetail,
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: unwrappedForOps}
 		}
-
-		contentType := resp.Header.Get("Content-Type")
 		if contentType == "" {
 			contentType = "application/json"
 		}

backend/internal/service/error_passthrough_service.go

@@ -0,0 +1,300 @@
+package service
+
+import (
+	"context"
+	"log"
+	"sort"
+	"strings"
+	"sync"
+
+	"github.com/Wei-Shaw/sub2api/internal/model"
+)
+
+// ErrorPassthroughRepository 定义错误透传规则的数据访问接口
+type ErrorPassthroughRepository interface {
+	// List 获取所有规则
+	List(ctx context.Context) ([]*model.ErrorPassthroughRule, error)
+	// GetByID 根据 ID 获取规则
+	GetByID(ctx context.Context, id int64) (*model.ErrorPassthroughRule, error)
+	// Create 创建规则
+	Create(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error)
+	// Update 更新规则
+	Update(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error)
+	// Delete 删除规则
+	Delete(ctx context.Context, id int64) error
+}
+
+// ErrorPassthroughCache 定义错误透传规则的缓存接口
+type ErrorPassthroughCache interface {
+	// Get 从缓存获取规则列表
+	Get(ctx context.Context) ([]*model.ErrorPassthroughRule, bool)
+	// Set 设置缓存
+	Set(ctx context.Context, rules []*model.ErrorPassthroughRule) error
+	// Invalidate 使缓存失效
+	Invalidate(ctx context.Context) error
+	// NotifyUpdate 通知其他实例刷新缓存
+	NotifyUpdate(ctx context.Context) error
+	// SubscribeUpdates 订阅缓存更新通知
+	SubscribeUpdates(ctx context.Context, handler func())
+}
+
+// ErrorPassthroughService 错误透传规则服务
+type ErrorPassthroughService struct {
+	repo  ErrorPassthroughRepository
+	cache ErrorPassthroughCache
+
+	// 本地内存缓存，用于快速匹配
+	localCache   []*model.ErrorPassthroughRule
+	localCacheMu sync.RWMutex
+}
+
+// NewErrorPassthroughService 创建错误透传规则服务
+func NewErrorPassthroughService(
+	repo ErrorPassthroughRepository,
+	cache ErrorPassthroughCache,
+) *ErrorPassthroughService {
+	svc := &ErrorPassthroughService{
+		repo:  repo,
+		cache: cache,
+	}
+
+	// 启动时加载规则到本地缓存
+	ctx := context.Background()
+	if err := svc.refreshLocalCache(ctx); err != nil {
+		log.Printf("[ErrorPassthroughService] Failed to load rules on startup: %v", err)
+	}
+
+	// 订阅缓存更新通知
+	if cache != nil {
+		cache.SubscribeUpdates(ctx, func() {
+			if err := svc.refreshLocalCache(context.Background()); err != nil {
+				log.Printf("[ErrorPassthroughService] Failed to refresh cache on notification: %v", err)
+			}
+		})
+	}
+
+	return svc
+}
+
+// List 获取所有规则
+func (s *ErrorPassthroughService) List(ctx context.Context) ([]*model.ErrorPassthroughRule, error) {
+	return s.repo.List(ctx)
+}
+
+// GetByID 根据 ID 获取规则
+func (s *ErrorPassthroughService) GetByID(ctx context.Context, id int64) (*model.ErrorPassthroughRule, error) {
+	return s.repo.GetByID(ctx, id)
+}
+
+// Create 创建规则
+func (s *ErrorPassthroughService) Create(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error) {
+	if err := rule.Validate(); err != nil {
+		return nil, err
+	}
+
+	created, err := s.repo.Create(ctx, rule)
+	if err != nil {
+		return nil, err
+	}
+
+	// 刷新缓存
+	s.invalidateAndNotify(ctx)
+
+	return created, nil
+}
+
+// Update 更新规则
+func (s *ErrorPassthroughService) Update(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error) {
+	if err := rule.Validate(); err != nil {
+		return nil, err
+	}
+
+	updated, err := s.repo.Update(ctx, rule)
+	if err != nil {
+		return nil, err
+	}
+
+	// 刷新缓存
+	s.invalidateAndNotify(ctx)
+
+	return updated, nil
+}
+
+// Delete 删除规则
+func (s *ErrorPassthroughService) Delete(ctx context.Context, id int64) error {
+	if err := s.repo.Delete(ctx, id); err != nil {
+		return err
+	}
+
+	// 刷新缓存
+	s.invalidateAndNotify(ctx)
+
+	return nil
+}
+
+// MatchRule 匹配透传规则
+// 返回第一个匹配的规则，如果没有匹配则返回 nil
+func (s *ErrorPassthroughService) MatchRule(platform string, statusCode int, body []byte) *model.ErrorPassthroughRule {
+	rules := s.getCachedRules()
+	if len(rules) == 0 {
+		return nil
+	}
+
+	bodyStr := strings.ToLower(string(body))
+
+	for _, rule := range rules {
+		if !rule.Enabled {
+			continue
+		}
+		if !s.platformMatches(rule, platform) {
+			continue
+		}
+		if s.ruleMatches(rule, statusCode, bodyStr) {
+			return rule
+		}
+	}
+
+	return nil
+}
+
+// getCachedRules 获取缓存的规则列表（按优先级排序）
+func (s *ErrorPassthroughService) getCachedRules() []*model.ErrorPassthroughRule {
+	s.localCacheMu.RLock()
+	rules := s.localCache
+	s.localCacheMu.RUnlock()
+
+	if rules != nil {
+		return rules
+	}
+
+	// 如果本地缓存为空，尝试刷新
+	ctx := context.Background()
+	if err := s.refreshLocalCache(ctx); err != nil {
+		log.Printf("[ErrorPassthroughService] Failed to refresh cache: %v", err)
+		return nil
+	}
+
+	s.localCacheMu.RLock()
+	defer s.localCacheMu.RUnlock()
+	return s.localCache
+}
+
+// refreshLocalCache 刷新本地缓存
+func (s *ErrorPassthroughService) refreshLocalCache(ctx context.Context) error {
+	// 先尝试从 Redis 缓存获取
+	if s.cache != nil {
+		if rules, ok := s.cache.Get(ctx); ok {
+			s.setLocalCache(rules)
+			return nil
+		}
+	}
+
+	// 从数据库加载（repo.List 已按 priority 排序）
+	rules, err := s.repo.List(ctx)
+	if err != nil {
+		return err
+	}
+
+	// 更新 Redis 缓存
+	if s.cache != nil {
+		if err := s.cache.Set(ctx, rules); err != nil {
+			log.Printf("[ErrorPassthroughService] Failed to set cache: %v", err)
+		}
+	}
+
+	// 更新本地缓存（setLocalCache 内部会确保排序）
+	s.setLocalCache(rules)
+
+	return nil
+}
+
+// setLocalCache 设置本地缓存
+func (s *ErrorPassthroughService) setLocalCache(rules []*model.ErrorPassthroughRule) {
+	// 按优先级排序
+	sorted := make([]*model.ErrorPassthroughRule, len(rules))
+	copy(sorted, rules)
+	sort.Slice(sorted, func(i, j int) bool {
+		return sorted[i].Priority < sorted[j].Priority
+	})
+
+	s.localCacheMu.Lock()
+	s.localCache = sorted
+	s.localCacheMu.Unlock()
+}
+
+// invalidateAndNotify 使缓存失效并通知其他实例
+func (s *ErrorPassthroughService) invalidateAndNotify(ctx context.Context) {
+	// 刷新本地缓存
+	if err := s.refreshLocalCache(ctx); err != nil {
+		log.Printf("[ErrorPassthroughService] Failed to refresh local cache: %v", err)
+	}
+
+	// 通知其他实例
+	if s.cache != nil {
+		if err := s.cache.NotifyUpdate(ctx); err != nil {
+			log.Printf("[ErrorPassthroughService] Failed to notify cache update: %v", err)
+		}
+	}
+}
+
+// platformMatches 检查平台是否匹配
+func (s *ErrorPassthroughService) platformMatches(rule *model.ErrorPassthroughRule, platform string) bool {
+	// 如果没有配置平台限制，则匹配所有平台
+	if len(rule.Platforms) == 0 {
+		return true
+	}
+
+	platform = strings.ToLower(platform)
+	for _, p := range rule.Platforms {
+		if strings.ToLower(p) == platform {
+			return true
+		}
+	}
+
+	return false
+}
+
+// ruleMatches 检查规则是否匹配
+func (s *ErrorPassthroughService) ruleMatches(rule *model.ErrorPassthroughRule, statusCode int, bodyLower string) bool {
+	hasErrorCodes := len(rule.ErrorCodes) > 0
+	hasKeywords := len(rule.Keywords) > 0
+
+	// 如果没有配置任何条件，不匹配
+	if !hasErrorCodes && !hasKeywords {
+		return false
+	}
+
+	codeMatch := !hasErrorCodes || s.containsInt(rule.ErrorCodes, statusCode)
+	keywordMatch := !hasKeywords || s.containsAnyKeyword(bodyLower, rule.Keywords)
+
+	if rule.MatchMode == model.MatchModeAll {
+		// "all" 模式：所有配置的条件都必须满足
+		return codeMatch && keywordMatch
+	}
+
+	// "any" 模式：任一条件满足即可
+	if hasErrorCodes && hasKeywords {
+		return codeMatch || keywordMatch
+	}
+	return codeMatch && keywordMatch
+}
+
+// containsInt 检查切片是否包含指定整数
+func (s *ErrorPassthroughService) containsInt(slice []int, val int) bool {
+	for _, v := range slice {
+		if v == val {
+			return true
+		}
+	}
+	return false
+}
+
+// containsAnyKeyword 检查字符串是否包含任一关键词（不区分大小写）
+func (s *ErrorPassthroughService) containsAnyKeyword(bodyLower string, keywords []string) bool {
+	for _, kw := range keywords {
+		if strings.Contains(bodyLower, strings.ToLower(kw)) {
+			return true
+		}
+	}
+	return false
+}

backend/internal/service/error_passthrough_service_test.go

@@ -0,0 +1,755 @@
+//go:build unit
+
+package service
+
+import (
+	"context"
+	"strings"
+	"testing"
+
+	"github.com/Wei-Shaw/sub2api/internal/model"
+	"github.com/stretchr/testify/assert"
+	"github.com/stretchr/testify/require"
+)
+
+// mockErrorPassthroughRepo 用于测试的 mock repository
+type mockErrorPassthroughRepo struct {
+	rules []*model.ErrorPassthroughRule
+}
+
+func (m *mockErrorPassthroughRepo) List(ctx context.Context) ([]*model.ErrorPassthroughRule, error) {
+	return m.rules, nil
+}
+
+func (m *mockErrorPassthroughRepo) GetByID(ctx context.Context, id int64) (*model.ErrorPassthroughRule, error) {
+	for _, r := range m.rules {
+		if r.ID == id {
+			return r, nil
+		}
+	}
+	return nil, nil
+}
+
+func (m *mockErrorPassthroughRepo) Create(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error) {
+	rule.ID = int64(len(m.rules) + 1)
+	m.rules = append(m.rules, rule)
+	return rule, nil
+}
+
+func (m *mockErrorPassthroughRepo) Update(ctx context.Context, rule *model.ErrorPassthroughRule) (*model.ErrorPassthroughRule, error) {
+	for i, r := range m.rules {
+		if r.ID == rule.ID {
+			m.rules[i] = rule
+			return rule, nil
+		}
+	}
+	return rule, nil
+}
+
+func (m *mockErrorPassthroughRepo) Delete(ctx context.Context, id int64) error {
+	for i, r := range m.rules {
+		if r.ID == id {
+			m.rules = append(m.rules[:i], m.rules[i+1:]...)
+			return nil
+		}
+	}
+	return nil
+}
+
+// newTestService 创建测试用的服务实例
+func newTestService(rules []*model.ErrorPassthroughRule) *ErrorPassthroughService {
+	repo := &mockErrorPassthroughRepo{rules: rules}
+	svc := &ErrorPassthroughService{
+		repo:  repo,
+		cache: nil, // 不使用缓存
+	}
+	// 直接设置本地缓存，避免调用 refreshLocalCache
+	svc.setLocalCache(rules)
+	return svc
+}
+
+// =============================================================================
+// 测试 ruleMatches 核心匹配逻辑
+// =============================================================================
+
+func TestRuleMatches_NoConditions(t *testing.T) {
+	// 没有配置任何条件时，不应该匹配
+	svc := newTestService(nil)
+	rule := &model.ErrorPassthroughRule{
+		Enabled:    true,
+		ErrorCodes: []int{},
+		Keywords:   []string{},
+		MatchMode:  model.MatchModeAny,
+	}
+
+	assert.False(t, svc.ruleMatches(rule, 422, "some error message"),
+		"没有配置条件时不应该匹配")
+}
+
+func TestRuleMatches_OnlyErrorCodes_AnyMode(t *testing.T) {
+	svc := newTestService(nil)
+	rule := &model.ErrorPassthroughRule{
+		Enabled:    true,
+		ErrorCodes: []int{422, 400},
+		Keywords:   []string{},
+		MatchMode:  model.MatchModeAny,
+	}
+
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		expected   bool
+	}{
+		{"状态码匹配 422", 422, "any message", true},
+		{"状态码匹配 400", 400, "any message", true},
+		{"状态码不匹配 500", 500, "any message", false},
+		{"状态码不匹配 429", 429, "any message", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := svc.ruleMatches(rule, tt.statusCode, tt.body)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestRuleMatches_OnlyKeywords_AnyMode(t *testing.T) {
+	svc := newTestService(nil)
+	rule := &model.ErrorPassthroughRule{
+		Enabled:    true,
+		ErrorCodes: []int{},
+		Keywords:   []string{"context limit", "model not supported"},
+		MatchMode:  model.MatchModeAny,
+	}
+
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		expected   bool
+	}{
+		{"关键词匹配 context limit", 500, "error: context limit reached", true},
+		{"关键词匹配 model not supported", 400, "the model not supported here", true},
+		{"关键词不匹配", 422, "some other error", false},
+		// 注意：ruleMatches 接收的 body 参数应该是已经转换为小写的
+		// 实际使用时，MatchRule 会先将 body 转换为小写再传给 ruleMatches
+		{"关键词大小写 - 输入已小写", 500, "context limit exceeded", true},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			// 模拟 MatchRule 的行为：先转换为小写
+			bodyLower := strings.ToLower(tt.body)
+			result := svc.ruleMatches(rule, tt.statusCode, bodyLower)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+func TestRuleMatches_BothConditions_AnyMode(t *testing.T) {
+	// any 模式：错误码 OR 关键词
+	svc := newTestService(nil)
+	rule := &model.ErrorPassthroughRule{
+		Enabled:    true,
+		ErrorCodes: []int{422, 400},
+		Keywords:   []string{"context limit"},
+		MatchMode:  model.MatchModeAny,
+	}
+
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		expected   bool
+		reason     string
+	}{
+		{
+			name:       "状态码和关键词都匹配",
+			statusCode: 422,
+			body:       "context limit reached",
+			expected:   true,
+			reason:     "both match",
+		},
+		{
+			name:       "只有状态码匹配",
+			statusCode: 422,
+			body:       "some other error",
+			expected:   true,
+			reason:     "code matches, keyword doesn't - OR mode should match",
+		},
+		{
+			name:       "只有关键词匹配",
+			statusCode: 500,
+			body:       "context limit exceeded",
+			expected:   true,
+			reason:     "keyword matches, code doesn't - OR mode should match",
+		},
+		{
+			name:       "都不匹配",
+			statusCode: 500,
+			body:       "some other error",
+			expected:   false,
+			reason:     "neither matches",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := svc.ruleMatches(rule, tt.statusCode, tt.body)
+			assert.Equal(t, tt.expected, result, tt.reason)
+		})
+	}
+}
+
+func TestRuleMatches_BothConditions_AllMode(t *testing.T) {
+	// all 模式：错误码 AND 关键词
+	svc := newTestService(nil)
+	rule := &model.ErrorPassthroughRule{
+		Enabled:    true,
+		ErrorCodes: []int{422, 400},
+		Keywords:   []string{"context limit"},
+		MatchMode:  model.MatchModeAll,
+	}
+
+	tests := []struct {
+		name       string
+		statusCode int
+		body       string
+		expected   bool
+		reason     string
+	}{
+		{
+			name:       "状态码和关键词都匹配",
+			statusCode: 422,
+			body:       "context limit reached",
+			expected:   true,
+			reason:     "both match - AND mode should match",
+		},
+		{
+			name:       "只有状态码匹配",
+			statusCode: 422,
+			body:       "some other error",
+			expected:   false,
+			reason:     "code matches but keyword doesn't - AND mode should NOT match",
+		},
+		{
+			name:       "只有关键词匹配",
+			statusCode: 500,
+			body:       "context limit exceeded",
+			expected:   false,
+			reason:     "keyword matches but code doesn't - AND mode should NOT match",
+		},
+		{
+			name:       "都不匹配",
+			statusCode: 500,
+			body:       "some other error",
+			expected:   false,
+			reason:     "neither matches",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			result := svc.ruleMatches(rule, tt.statusCode, tt.body)
+			assert.Equal(t, tt.expected, result, tt.reason)
+		})
+	}
+}
+
+// =============================================================================
+// 测试 platformMatches 平台匹配逻辑
+// =============================================================================
+
+func TestPlatformMatches(t *testing.T) {
+	svc := newTestService(nil)
+
+	tests := []struct {
+		name            string
+		rulePlatforms   []string
+		requestPlatform string
+		expected        bool
+	}{
+		{
+			name:            "空平台列表匹配所有",
+			rulePlatforms:   []string{},
+			requestPlatform: "anthropic",
+			expected:        true,
+		},
+		{
+			name:            "nil平台列表匹配所有",
+			rulePlatforms:   nil,
+			requestPlatform: "openai",
+			expected:        true,
+		},
+		{
+			name:            "精确匹配 anthropic",
+			rulePlatforms:   []string{"anthropic", "openai"},
+			requestPlatform: "anthropic",
+			expected:        true,
+		},
+		{
+			name:            "精确匹配 openai",
+			rulePlatforms:   []string{"anthropic", "openai"},
+			requestPlatform: "openai",
+			expected:        true,
+		},
+		{
+			name:            "不匹配 gemini",
+			rulePlatforms:   []string{"anthropic", "openai"},
+			requestPlatform: "gemini",
+			expected:        false,
+		},
+		{
+			name:            "大小写不敏感",
+			rulePlatforms:   []string{"Anthropic", "OpenAI"},
+			requestPlatform: "anthropic",
+			expected:        true,
+		},
+		{
+			name:            "匹配 antigravity",
+			rulePlatforms:   []string{"antigravity"},
+			requestPlatform: "antigravity",
+			expected:        true,
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			rule := &model.ErrorPassthroughRule{
+				Platforms: tt.rulePlatforms,
+			}
+			result := svc.platformMatches(rule, tt.requestPlatform)
+			assert.Equal(t, tt.expected, result)
+		})
+	}
+}
+
+// =============================================================================
+// 测试 MatchRule 完整匹配流程
+// =============================================================================
+
+func TestMatchRule_Priority(t *testing.T) {
+	// 测试规则按优先级排序，优先级小的先匹配
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:         1,
+			Name:       "Low Priority",
+			Enabled:    true,
+			Priority:   10,
+			ErrorCodes: []int{422},
+			MatchMode:  model.MatchModeAny,
+		},
+		{
+			ID:         2,
+			Name:       "High Priority",
+			Enabled:    true,
+			Priority:   1,
+			ErrorCodes: []int{422},
+			MatchMode:  model.MatchModeAny,
+		},
+	}
+
+	svc := newTestService(rules)
+	matched := svc.MatchRule("anthropic", 422, []byte("error"))
+
+	require.NotNil(t, matched)
+	assert.Equal(t, int64(2), matched.ID, "应该匹配优先级更高(数值更小)的规则")
+	assert.Equal(t, "High Priority", matched.Name)
+}
+
+func TestMatchRule_DisabledRule(t *testing.T) {
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:         1,
+			Name:       "Disabled Rule",
+			Enabled:    false,
+			Priority:   1,
+			ErrorCodes: []int{422},
+			MatchMode:  model.MatchModeAny,
+		},
+		{
+			ID:         2,
+			Name:       "Enabled Rule",
+			Enabled:    true,
+			Priority:   10,
+			ErrorCodes: []int{422},
+			MatchMode:  model.MatchModeAny,
+		},
+	}
+
+	svc := newTestService(rules)
+	matched := svc.MatchRule("anthropic", 422, []byte("error"))
+
+	require.NotNil(t, matched)
+	assert.Equal(t, int64(2), matched.ID, "应该跳过禁用的规则")
+}
+
+func TestMatchRule_PlatformFilter(t *testing.T) {
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:         1,
+			Name:       "Anthropic Only",
+			Enabled:    true,
+			Priority:   1,
+			ErrorCodes: []int{422},
+			Platforms:  []string{"anthropic"},
+			MatchMode:  model.MatchModeAny,
+		},
+		{
+			ID:         2,
+			Name:       "OpenAI Only",
+			Enabled:    true,
+			Priority:   2,
+			ErrorCodes: []int{422},
+			Platforms:  []string{"openai"},
+			MatchMode:  model.MatchModeAny,
+		},
+		{
+			ID:         3,
+			Name:       "All Platforms",
+			Enabled:    true,
+			Priority:   3,
+			ErrorCodes: []int{422},
+			Platforms:  []string{},
+			MatchMode:  model.MatchModeAny,
+		},
+	}
+
+	svc := newTestService(rules)
+
+	t.Run("Anthropic 请求匹配 Anthropic 规则", func(t *testing.T) {
+		matched := svc.MatchRule("anthropic", 422, []byte("error"))
+		require.NotNil(t, matched)
+		assert.Equal(t, int64(1), matched.ID)
+	})
+
+	t.Run("OpenAI 请求匹配 OpenAI 规则", func(t *testing.T) {
+		matched := svc.MatchRule("openai", 422, []byte("error"))
+		require.NotNil(t, matched)
+		assert.Equal(t, int64(2), matched.ID)
+	})
+
+	t.Run("Gemini 请求匹配全平台规则", func(t *testing.T) {
+		matched := svc.MatchRule("gemini", 422, []byte("error"))
+		require.NotNil(t, matched)
+		assert.Equal(t, int64(3), matched.ID)
+	})
+
+	t.Run("Antigravity 请求匹配全平台规则", func(t *testing.T) {
+		matched := svc.MatchRule("antigravity", 422, []byte("error"))
+		require.NotNil(t, matched)
+		assert.Equal(t, int64(3), matched.ID)
+	})
+}
+
+func TestMatchRule_NoMatch(t *testing.T) {
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:         1,
+			Name:       "Rule for 422",
+			Enabled:    true,
+			Priority:   1,
+			ErrorCodes: []int{422},
+			MatchMode:  model.MatchModeAny,
+		},
+	}
+
+	svc := newTestService(rules)
+	matched := svc.MatchRule("anthropic", 500, []byte("error"))
+
+	assert.Nil(t, matched, "不匹配任何规则时应返回 nil")
+}
+
+func TestMatchRule_EmptyRules(t *testing.T) {
+	svc := newTestService([]*model.ErrorPassthroughRule{})
+	matched := svc.MatchRule("anthropic", 422, []byte("error"))
+
+	assert.Nil(t, matched, "没有规则时应返回 nil")
+}
+
+func TestMatchRule_CaseInsensitiveKeyword(t *testing.T) {
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:        1,
+			Name:      "Context Limit",
+			Enabled:   true,
+			Priority:  1,
+			Keywords:  []string{"Context Limit"},
+			MatchMode: model.MatchModeAny,
+		},
+	}
+
+	svc := newTestService(rules)
+
+	tests := []struct {
+		name     string
+		body     string
+		expected bool
+	}{
+		{"完全匹配", "Context Limit reached", true},
+		{"小写匹配", "context limit reached", true},
+		{"大写匹配", "CONTEXT LIMIT REACHED", true},
+		{"混合大小写", "ConTeXt LiMiT error", true},
+		{"不匹配", "some other error", false},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			matched := svc.MatchRule("anthropic", 500, []byte(tt.body))
+			if tt.expected {
+				assert.NotNil(t, matched)
+			} else {
+				assert.Nil(t, matched)
+			}
+		})
+	}
+}
+
+// =============================================================================
+// 测试真实场景
+// =============================================================================
+
+func TestMatchRule_RealWorldScenario_ContextLimitPassthrough(t *testing.T) {
+	// 场景：上游返回 422 + "context limit has been reached"，需要透传给客户端
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:              1,
+			Name:            "Context Limit Passthrough",
+			Enabled:         true,
+			Priority:        1,
+			ErrorCodes:      []int{422},
+			Keywords:        []string{"context limit"},
+			MatchMode:       model.MatchModeAll, // 必须同时满足
+			Platforms:       []string{"anthropic", "antigravity"},
+			PassthroughCode: true,
+			PassthroughBody: true,
+		},
+	}
+
+	svc := newTestService(rules)
+
+	// 测试 Anthropic 平台
+	t.Run("Anthropic 422 with context limit", func(t *testing.T) {
+		body := []byte(`{"type":"error","error":{"type":"invalid_request","message":"The context limit has been reached"}}`)
+		matched := svc.MatchRule("anthropic", 422, body)
+		require.NotNil(t, matched)
+		assert.True(t, matched.PassthroughCode)
+		assert.True(t, matched.PassthroughBody)
+	})
+
+	// 测试 Antigravity 平台
+	t.Run("Antigravity 422 with context limit", func(t *testing.T) {
+		body := []byte(`{"error":"context limit exceeded"}`)
+		matched := svc.MatchRule("antigravity", 422, body)
+		require.NotNil(t, matched)
+	})
+
+	// 测试 OpenAI 平台（不在规则的平台列表中）
+	t.Run("OpenAI should not match", func(t *testing.T) {
+		body := []byte(`{"error":"context limit exceeded"}`)
+		matched := svc.MatchRule("openai", 422, body)
+		assert.Nil(t, matched, "OpenAI 不在规则的平台列表中")
+	})
+
+	// 测试状态码不匹配
+	t.Run("Wrong status code", func(t *testing.T) {
+		body := []byte(`{"error":"context limit exceeded"}`)
+		matched := svc.MatchRule("anthropic", 400, body)
+		assert.Nil(t, matched, "状态码不匹配")
+	})
+
+	// 测试关键词不匹配
+	t.Run("Wrong keyword", func(t *testing.T) {
+		body := []byte(`{"error":"rate limit exceeded"}`)
+		matched := svc.MatchRule("anthropic", 422, body)
+		assert.Nil(t, matched, "关键词不匹配")
+	})
+}
+
+func TestMatchRule_RealWorldScenario_CustomErrorMessage(t *testing.T) {
+	// 场景：某些错误需要返回自定义消息，隐藏上游详细信息
+	customMsg := "Service temporarily unavailable, please try again later"
+	responseCode := 503
+	rules := []*model.ErrorPassthroughRule{
+		{
+			ID:              1,
+			Name:            "Hide Internal Errors",
+			Enabled:         true,
+			Priority:        1,
+			ErrorCodes:      []int{500, 502, 503},
+			MatchMode:       model.MatchModeAny,
+			PassthroughCode: false,
+			ResponseCode:    &responseCode,
+			PassthroughBody: false,
+			CustomMessage:   &customMsg,
+		},
+	}
+
+	svc := newTestService(rules)
+
+	matched := svc.MatchRule("anthropic", 500, []byte("internal server error"))
+	require.NotNil(t, matched)
+	assert.False(t, matched.PassthroughCode)
+	assert.Equal(t, 503, *matched.ResponseCode)
+	assert.False(t, matched.PassthroughBody)
+	assert.Equal(t, customMsg, *matched.CustomMessage)
+}
+
+// =============================================================================
+// 测试 model.Validate
+// =============================================================================
+
+func TestErrorPassthroughRule_Validate(t *testing.T) {
+	tests := []struct {
+		name        string
+		rule        *model.ErrorPassthroughRule
+		expectError bool
+		errorField  string
+	}{
+		{
+			name: "有效规则 - 透传模式（含错误码）",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Valid Rule",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{422},
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: false,
+		},
+		{
+			name: "有效规则 - 透传模式（含关键词）",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Valid Rule",
+				MatchMode:       model.MatchModeAny,
+				Keywords:        []string{"context limit"},
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: false,
+		},
+		{
+			name: "有效规则 - 自定义响应",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Valid Rule",
+				MatchMode:       model.MatchModeAll,
+				ErrorCodes:      []int{500},
+				Keywords:        []string{"internal error"},
+				PassthroughCode: false,
+				ResponseCode:    testIntPtr(503),
+				PassthroughBody: false,
+				CustomMessage:   testStrPtr("Custom error"),
+			},
+			expectError: false,
+		},
+		{
+			name: "缺少名称",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{422},
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: true,
+			errorField:  "name",
+		},
+		{
+			name: "无效的匹配模式",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Invalid Mode",
+				MatchMode:       "invalid",
+				ErrorCodes:      []int{422},
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: true,
+			errorField:  "match_mode",
+		},
+		{
+			name: "缺少匹配条件（错误码和关键词都为空）",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "No Conditions",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{},
+				Keywords:        []string{},
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: true,
+			errorField:  "conditions",
+		},
+		{
+			name: "缺少匹配条件（nil切片）",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Nil Conditions",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      nil,
+				Keywords:        nil,
+				PassthroughCode: true,
+				PassthroughBody: true,
+			},
+			expectError: true,
+			errorField:  "conditions",
+		},
+		{
+			name: "自定义状态码但未提供值",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Missing Code",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{422},
+				PassthroughCode: false,
+				ResponseCode:    nil,
+				PassthroughBody: true,
+			},
+			expectError: true,
+			errorField:  "response_code",
+		},
+		{
+			name: "自定义消息但未提供值",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Missing Message",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{422},
+				PassthroughCode: true,
+				PassthroughBody: false,
+				CustomMessage:   nil,
+			},
+			expectError: true,
+			errorField:  "custom_message",
+		},
+		{
+			name: "自定义消息为空字符串",
+			rule: &model.ErrorPassthroughRule{
+				Name:            "Empty Message",
+				MatchMode:       model.MatchModeAny,
+				ErrorCodes:      []int{422},
+				PassthroughCode: true,
+				PassthroughBody: false,
+				CustomMessage:   testStrPtr(""),
+			},
+			expectError: true,
+			errorField:  "custom_message",
+		},
+	}
+
+	for _, tt := range tests {
+		t.Run(tt.name, func(t *testing.T) {
+			err := tt.rule.Validate()
+			if tt.expectError {
+				require.Error(t, err)
+				validationErr, ok := err.(*model.ValidationError)
+				require.True(t, ok, "应该返回 ValidationError")
+				assert.Equal(t, tt.errorField, validationErr.Field)
+			} else {
+				assert.NoError(t, err)
+			}
+		})
+	}
+}
+
+// Helper functions
+func testIntPtr(i int) *int       { return &i }
+func testStrPtr(s string) *string { return &s }

backend/internal/service/gateway_service.go

@@ -370,7 +370,8 @@ type ForwardResult struct {
 
 // UpstreamFailoverError indicates an upstream error that should trigger account failover.
 type UpstreamFailoverError struct {
-	StatusCode int
+	StatusCode   int
+	ResponseBody []byte // 上游响应体，用于错误透传规则匹配
 }
 
 func (e *UpstreamFailoverError) Error() string {
@@ -3284,7 +3285,7 @@ func (s *GatewayService) Forward(ctx context.Context, c *gin.Context, account *A
 					return ""
 				}(),
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 		}
 		return s.handleRetryExhaustedError(ctx, resp, c, account)
 	}
@@ -3314,10 +3315,8 @@ func (s *GatewayService) Forward(ctx context.Context, c *gin.Context, account *A
 				return ""
 			}(),
 		})
-		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 	}
-
-	// 处理错误响应（不可重试的错误）
 	if resp.StatusCode >= 400 {
 		// 可选：对部分 400 触发 failover（默认关闭以保持语义）
 		if resp.StatusCode == 400 && s.cfg != nil && s.cfg.Gateway.FailoverOn400 {
@@ -3361,7 +3360,7 @@ func (s *GatewayService) Forward(ctx context.Context, c *gin.Context, account *A
 					log.Printf("Account %d: 400 error, attempting failover", account.ID)
 				}
 				s.handleFailoverSideEffects(ctx, resp, account)
-				return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+				return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 			}
 		}
 		return s.handleErrorResponse(ctx, resp, c, account)
@@ -3758,6 +3757,12 @@ func (s *GatewayService) shouldFailoverOn400(respBody []byte) bool {
 	return false
 }
 
+// ExtractUpstreamErrorMessage 从上游响应体中提取错误消息
+// 支持 Claude 风格的错误格式：{"type":"error","error":{"type":"...","message":"..."}}
+func ExtractUpstreamErrorMessage(body []byte) string {
+	return extractUpstreamErrorMessage(body)
+}
+
 func extractUpstreamErrorMessage(body []byte) string {
 	// Claude 风格：{"type":"error","error":{"type":"...","message":"..."}}
 	if m := gjson.GetBytes(body, "error.message").String(); strings.TrimSpace(m) != "" {
@@ -3825,7 +3830,7 @@ func (s *GatewayService) handleErrorResponse(ctx context.Context, resp *http.Res
 		shouldDisable = s.rateLimitService.HandleUpstreamError(ctx, account, resp.StatusCode, resp.Header, body)
 	}
 	if shouldDisable {
-		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: body}
 	}
 
 	// 记录上游错误响应体摘要便于排障（可选：由配置控制；不回显到客户端）

backend/internal/service/gemini_messages_compat_service.go

@@ -864,7 +864,7 @@ func (s *GeminiMessagesCompatService) Forward(ctx context.Context, c *gin.Contex
 				Message:            upstreamMsg,
 				Detail:             upstreamDetail,
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 		}
 		if s.shouldFailoverGeminiUpstreamError(resp.StatusCode) {
 			upstreamReqID := resp.Header.Get(requestIDHeader)
@@ -891,7 +891,7 @@ func (s *GeminiMessagesCompatService) Forward(ctx context.Context, c *gin.Contex
 				Message:            upstreamMsg,
 				Detail:             upstreamDetail,
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 		}
 		upstreamReqID := resp.Header.Get(requestIDHeader)
 		if upstreamReqID == "" {
@@ -1301,7 +1301,7 @@ func (s *GeminiMessagesCompatService) ForwardNative(ctx context.Context, c *gin.
 				Message:            upstreamMsg,
 				Detail:             upstreamDetail,
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 		}
 		if s.shouldFailoverGeminiUpstreamError(resp.StatusCode) {
 			evBody := unwrapIfNeeded(isOAuth, respBody)
@@ -1325,7 +1325,7 @@ func (s *GeminiMessagesCompatService) ForwardNative(ctx context.Context, c *gin.
 				Message:            upstreamMsg,
 				Detail:             upstreamDetail,
 			})
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: evBody}
 		}
 
 		respBody = unwrapIfNeeded(isOAuth, respBody)

backend/internal/service/openai_gateway_service.go

@@ -940,7 +940,7 @@ func (s *OpenAIGatewayService) Forward(ctx context.Context, c *gin.Context, acco
 			})
 
 			s.handleFailoverSideEffects(ctx, resp, account)
-			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+			return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: respBody}
 		}
 		return s.handleErrorResponse(ctx, resp, c, account)
 	}
@@ -1131,7 +1131,7 @@ func (s *OpenAIGatewayService) handleErrorResponse(ctx context.Context, resp *ht
 		Detail:             upstreamDetail,
 	})
 	if shouldDisable {
-		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode}
+		return nil, &UpstreamFailoverError{StatusCode: resp.StatusCode, ResponseBody: body}
 	}
 
 	// Return appropriate error response

backend/internal/service/wire.go

@@ -274,4 +274,5 @@ var ProviderSet = wire.NewSet(
 	NewUserAttributeService,
 	NewUsageCache,
 	NewTotpService,
+	NewErrorPassthroughService,
 )