From a1980aeb40b24f3035754cec06a5551a526e54e6 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Tue, 29 Sep 2026 19:48:49 +0700
Subject: [PATCH 1/2] Port upstream 0.67.0: Add Aixy provider (key budgets and
 7-day usage)

---
 README.md                                     |   1 +
 .../src/commands/provider_settings.rs         |  40 +-
 .../src-tauri/src/commands/providers.rs       |   7 +-
 .../providers/icons/ProviderIcon-aixy.svg     |   1 +
 .../src/components/providers/providerIcons.ts |   3 +
 apps/desktop-tauri/src/i18n/keys.ts           |   5 +
 apps/desktop-tauri/src/surfaces/TrayPanel.tsx |   2 +-
 .../settings/providers/ProviderDetailPane.tsx |  14 +-
 .../sections/MenuBarMetricSection.test.tsx    |  19 +
 .../sections/MenuBarMetricSection.tsx         |  35 +-
 .../sections/WayfinderGatewaySection.test.tsx |  53 ++
 .../sections/WayfinderGatewaySection.tsx      |  43 +-
 .../providers/sections/usageSourcePolicy.ts   |   6 +
 .../desktop-tauri/src/test/providerCatalog.ts |   1 +
 docs/PROVIDERS.md                             |  24 +
 rust/src/core/provider.rs                     |  10 +-
 rust/src/core/provider_factory.rs             |  34 +-
 rust/src/core/token_accounts.rs               |  24 +
 rust/src/locale.rs                            |   5 +
 rust/src/locale/en-US.ftl                     |   5 +
 .../providers/aixy/fixtures/key-usage.json    | 134 +++++
 rust/src/providers/aixy/mod.rs                | 215 ++++++++
 rust/src/providers/aixy/model.rs              | 411 ++++++++++++++
 rust/src/providers/aixy/present.rs            | 173 ++++++
 rust/src/providers/aixy/tests.rs              | 504 ++++++++++++++++++
 rust/src/providers/bifrost/mod.rs             |  16 +-
 rust/src/providers/mod.rs                     |  22 +
 rust/src/settings/api_keys.rs                 |  11 +
 28 files changed, 1760 insertions(+), 58 deletions(-)
 create mode 100644 apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aixy.svg
 create mode 100644 apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.test.tsx
 create mode 100644 rust/src/providers/aixy/fixtures/key-usage.json
 create mode 100644 rust/src/providers/aixy/mod.rs
 create mode 100644 rust/src/providers/aixy/model.rs
 create mode 100644 rust/src/providers/aixy/present.rs
 create mode 100644 rust/src/providers/aixy/tests.rs

diff --git a/README.md b/README.md
index 2e052ad2f9..bd9e0de719 100755
--- a/README.md
+++ b/README.md
@@ -116,6 +116,7 @@ See the full history in [CHANGELOG.md](CHANGELOG.md).
 | Grok | Cookies / auth.json | Billing |
 | Helmcode (also NaN Builders) | Browser cookies / manual Cookie header | Per-model token quotas, reset windows, Helmcode prepaid balance |
 | Replicate | Cookies / token accounts | Monthly spend, credit balance |
+| Aixy | API Key / token accounts | Applicable budget balances, 7-day key usage |
 | ElevenLabs | API Key | Subscription Credits, Voice Slots |
 | Deepgram | API Key | Project Usage |
 | Groq | API Key | Enterprise Metrics |
diff --git a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
index 3aa5518b59..314baa56d8 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/provider_settings.rs
@@ -400,15 +400,48 @@ mod tests {
         );
     }
 
+    #[test]
+    fn fetch_context_carries_saved_gateway_urls_for_every_gateway_provider() {
+        use codexbar::settings::{ApiKeys, ManualCookies, Settings};
+        use std::collections::HashMap;
+
+        let mut settings = Settings::default();
+        for (id, url) in [
+            (ProviderId::Wayfinder, "http://localhost:8787"),
+            (ProviderId::Bifrost, "https://bifrost.example.com"),
+            (ProviderId::Aixy, "https://aixy.example.com/prefix"),
+        ] {
+            settings.set_gateway_url(id, url);
+            let ctx = super::super::providers::build_fetch_context(
+                id,
+                &settings,
+                &ManualCookies::default(),
+                &ApiKeys::default(),
+                &HashMap::new(),
+            );
+            assert_eq!(ctx.gateway_url.as_deref(), Some(url), "{id:?}");
+        }
+
+        let ctx = super::super::providers::build_fetch_context(
+            ProviderId::Codex,
+            &settings,
+            &ManualCookies::default(),
+            &ApiKeys::default(),
+            &HashMap::new(),
+        );
+        assert_eq!(ctx.gateway_url, None);
+    }
+
     #[test]
     fn maps_gitkraken_organization_provider() {
         assert_eq!(workspace_provider("gitkraken"), Some(ProviderId::GitKraken));
     }
 
     #[test]
-    fn gateway_provider_exposes_wayfinder_and_bifrost_only() {
+    fn gateway_provider_exposes_gateway_providers_only() {
         assert_eq!(gateway_provider("wayfinder"), Some(ProviderId::Wayfinder));
         assert_eq!(gateway_provider("bifrost"), Some(ProviderId::Bifrost));
+        assert_eq!(gateway_provider("aixy"), Some(ProviderId::Aixy));
         assert_eq!(gateway_provider("codex"), None);
     }
 
@@ -466,6 +499,7 @@ fn gateway_provider(provider_id: &str) -> Option<codexbar::core::ProviderId> {
     match provider_id {
         "wayfinder" => Some(codexbar::core::ProviderId::Wayfinder),
         "bifrost" => Some(codexbar::core::ProviderId::Bifrost),
+        "aixy" => Some(codexbar::core::ProviderId::Aixy),
         _ => None,
     }
 }
@@ -491,6 +525,10 @@ pub fn set_provider_gateway_url(provider_id: String, gateway_url: String) -> Res
             codexbar::providers::bifrost::validate_gateway_url(gateway_url)
                 .map_err(|error| error.to_string())?;
         }
+        codexbar::core::ProviderId::Aixy => {
+            codexbar::providers::aixy::validate_gateway_url(gateway_url)
+                .map_err(|error| error.to_string())?;
+        }
         _ => unreachable!("gateway_provider only returns gateway providers"),
     }
 
diff --git a/apps/desktop-tauri/src-tauri/src/commands/providers.rs b/apps/desktop-tauri/src-tauri/src/commands/providers.rs
index 779f9c801c..6ad574d3ca 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/providers.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/providers.rs
@@ -214,8 +214,11 @@ pub(crate) fn build_fetch_context(
 
     let workspace_id = settings.workspace_id(id).trim().to_string();
     let api_region = settings.api_region(id).trim().to_string();
-    let gateway_url = (id == ProviderId::Wayfinder && !settings.gateway_url(id).is_empty())
-        .then(|| settings.gateway_url(id).to_string());
+    // Every gateway-style provider (Wayfinder, Bifrost, Aixy) stores its base
+    // URL here; providers without one report an empty string.
+    let gateway_url = Some(settings.gateway_url(id))
+        .filter(|url| !url.is_empty())
+        .map(str::to_owned);
     // Local-first Auto providers (OpenCode Go) flip to web-first when a
     // token account or manual cookie source scopes the session to web creds.
     let auto_prefer_web = token_override.is_some() || cookie_source == "manual";
diff --git a/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aixy.svg b/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aixy.svg
new file mode 100644
index 0000000000..224bb877f1
--- /dev/null
+++ b/apps/desktop-tauri/src/components/providers/icons/ProviderIcon-aixy.svg
@@ -0,0 +1 @@
+<svg xmlns="http://www.w3.org/2000/svg" width="1024" height="1024" viewBox="0 0 64 64" role="img" aria-labelledby="title"><title id="title">Aixy</title><g transform="translate(32 32) scale(1.1) translate(-34.5 -30)"><path fill="#123650" fill-rule="evenodd" d="M18 47 30.6 16h4.6L48 47h-8.2l-2.6-7.2H27L24.2 47H18z M31.8 24.6l-2.7 8.2h6l-2.8-8.2h-.5z"/><circle cx="47" cy="17" r="4" fill="#ec744a"/></g></svg>
diff --git a/apps/desktop-tauri/src/components/providers/providerIcons.ts b/apps/desktop-tauri/src/components/providers/providerIcons.ts
index ee24a2c1f1..99ef91ee3d 100644
--- a/apps/desktop-tauri/src/components/providers/providerIcons.ts
+++ b/apps/desktop-tauri/src/components/providers/providerIcons.ts
@@ -20,6 +20,7 @@ import deepgram from "./icons/ProviderIcon-deepgram.svg?raw";
 import deepinfra from "./icons/ProviderIcon-deepinfra.svg?raw";
 import fireworks from "./icons/ProviderIcon-fireworks.svg?raw";
 import aiand from "./icons/ProviderIcon-aiand.svg?raw";
+import aixy from "./icons/ProviderIcon-aixy.svg?raw";
 import clinepass from "./icons/ProviderIcon-clinepass.svg?raw";
 import longcat from "./icons/ProviderIcon-longcat.svg?raw";
 import neuralwatt from "./icons/ProviderIcon-neuralwatt.svg?raw";
@@ -107,6 +108,7 @@ const RAW: Record<string, string> = {
   deepinfra: tint(deepinfra),
   fireworks: tint(fireworks),
   aiand: tint(aiand),
+  aixy: tint(aixy),
   clinepass: tint(clinepass),
   longcat: tint(longcat),
   neuralwatt: tint(neuralwatt),
@@ -186,6 +188,7 @@ export const PROVIDER_ICON_REGISTRY: Record<string, ProviderIcon> = {
   grok:        { id: "grok",        brandColor: "#111827", fallbackLetter: "G", svgPath: RAW.grok },
   groq:        { id: "groq",        brandColor: "#f55036", fallbackLetter: "G", svgPath: RAW.groq },
   bifrost:     { id: "bifrost",     brandColor: "#5b7cfa", fallbackLetter: "B" },
+  aixy:        { id: "aixy",        brandColor: "#123650", fallbackLetter: "A", svgPath: RAW.aixy },
   gitkraken:   { id: "gitkraken",   brandColor: "#179287", fallbackLetter: "G" },
   huggingface: { id: "huggingface", brandColor: "#ffd21e", fallbackLetter: "H", svgPath: RAW.huggingface },
   hyper:       { id: "hyper",       brandColor: "#7c3aed", fallbackLetter: "H" },
diff --git a/apps/desktop-tauri/src/i18n/keys.ts b/apps/desktop-tauri/src/i18n/keys.ts
index 1c07040562..904dd541f8 100644
--- a/apps/desktop-tauri/src/i18n/keys.ts
+++ b/apps/desktop-tauri/src/i18n/keys.ts
@@ -96,6 +96,11 @@ export const ALL_LOCALE_KEYS = [
   "WayfinderGatewayLabel",
   "WayfinderGatewayHelp",
   "WayfinderGatewayStatus",
+  "BifrostGatewayTitle",
+  "BifrostGatewayHelp",
+  "AixyGatewayTitle",
+  "AixyGatewayLabel",
+  "AixyGatewayHelp",
   "WayfinderModels",
   "WayfinderRequests",
   "WayfinderTokens",
diff --git a/apps/desktop-tauri/src/surfaces/TrayPanel.tsx b/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
index 09ead3c1d3..8e9c989a21 100644
--- a/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
+++ b/apps/desktop-tauri/src/surfaces/TrayPanel.tsx
@@ -30,7 +30,7 @@ import {
 const HAS_DASHBOARD = new Set([
   "abacus", "alibaba", "alibabatokenplan", "amp", "augment",
   "azureopenai", "bedrock", "claude", "codex", "codebuff",
-  "aiand", "commandcode", "copilot", "crossmodel", "cursor", "deepgram", "deepinfra", "deepseek", "zenmux", "clinepass", "longcat", "neuralwatt", "zoommate",
+  "aiand", "aixy", "commandcode", "copilot", "crossmodel", "cursor", "deepgram", "deepinfra", "deepseek", "zenmux", "clinepass", "longcat", "neuralwatt", "zoommate",
   "doubao", "elevenlabs", "factory", "gemini", "grok", "groq",
   "infini", "jetbrains", "kilo", "kimi", "kimik2", "kiro", "manus", "replicate",
   "mimo", "minimax", "mistral", "nanogpt", "notion", "ollama", "openaiapi",
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
index ae3e6766a5..5d8099a174 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/ProviderDetailPane.tsx
@@ -47,7 +47,10 @@ import { AccentColorSection } from "./sections/AccentColorSection";
 import { ProviderIssueNotice } from "./sections/ProviderIssueNotice";
 import { CredentialStorageSection } from "./sections/CredentialStorageSection";
 import { CredentialsDispatcher } from "./sections/CredentialsDispatcher";
-import { WayfinderGatewaySection } from "./sections/WayfinderGatewaySection";
+import {
+  isGatewayProviderId,
+  WayfinderGatewaySection,
+} from "./sections/WayfinderGatewaySection";
 import { AzureApiVersionSection } from "./sections/AzureApiVersionSection";
 
 interface Props {
@@ -145,9 +148,8 @@ export function ProviderDetailPane({
     }
   }, []);
 
-  const gatewayProviderId = providerId === "wayfinder" || providerId === "bifrost"
-    ? providerId
-    : null;
+  const gatewayProviderId =
+    providerId !== null && isGatewayProviderId(providerId) ? providerId : null;
 
   useEffect(() => {
     setGatewayLoadedProviderId(null);
@@ -345,9 +347,10 @@ export function ProviderDetailPane({
         t={t}
         onChanged={reload}
       />
-      {(detail.id === "wayfinder" || detail.id === "bifrost") &&
+      {isGatewayProviderId(detail.id) &&
         gatewayLoadedProviderId === detail.id && (
         <WayfinderGatewaySection
+          providerId={detail.id}
           draft={gatewayDraft}
           error={gatewayError}
           busy={busy}
@@ -357,7 +360,6 @@ export function ProviderDetailPane({
           }
           onSave={() => void saveGateway()}
           t={t}
-          bifrost={detail.id === "bifrost"}
         />
       )}
       <MenuBarMetricSection
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
index 46f0e21cd2..1c1315b9da 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
@@ -123,4 +123,23 @@ describe("MenuBarMetricSection", () => {
       providerMetrics: { copilot: "extraUsage" },
     });
   });
+
+  it("offers only Automatic for Aixy, even with extra budget windows", () => {
+    const aixy = provider();
+    aixy.id = "aixy";
+    aixy.displayName = "Aixy";
+    aixy.weekly = rateWindow(40);
+    render(
+      <MenuBarMetricSection
+        provider={aixy}
+        providerMetrics={{}}
+        disabled={false}
+        t={(key) => key}
+        onChange={vi.fn()}
+      />,
+    );
+
+    const options = screen.getAllByRole("option").map((option) => option.textContent);
+    expect(options).toEqual(["Automatic"]);
+  });
 });
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
index 7bc89e0d7d..f8ff1eb89f 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
@@ -20,6 +20,8 @@ interface MetricOption {
   label: string;
 }
 
+const AUTOMATIC_ONLY_PROVIDERS: ReadonlySet<string> = new Set(["aixy"]);
+
 export function MenuBarMetricSection({
   provider,
   providerMetrics,
@@ -76,11 +78,15 @@ function metricOptions(
   selected: MetricPreference,
   t: (key: LocaleKey) => string,
 ): MetricOption[] {
-  const options: MetricOption[] = [
-    { value: "automatic", label: t("Automatic") },
-    { value: "session", label: t("ProviderSessionLabel") },
-  ];
+  const options: MetricOption[] = [{ value: "automatic", label: t("Automatic") }];
+
+  // Aixy's primary budget depends on which limits currently apply to the key,
+  // so a fixed session/weekly lane would be misleading. Offer Automatic only.
+  if (AUTOMATIC_ONLY_PROVIDERS.has(provider.id)) {
+    return withSelected(options, selected, t);
+  }
 
+  options.push({ value: "session", label: t("ProviderSessionLabel") });
   if (provider.weekly) {
     options.push({ value: "weekly", label: t("ProviderWeeklyLabel") });
   }
@@ -104,12 +110,21 @@ function metricOptions(
   if (provider.id === "gemini" && provider.weekly) {
     options.push({ value: "average", label: t("Average") });
   }
-  if (!options.some((option) => option.value === selected)) {
-    options.push({
+  return withSelected(options, selected, t);
+}
+
+/** Keep a previously saved preference visible even if it is no longer offered. */
+function withSelected(
+  options: MetricOption[],
+  selected: MetricPreference,
+  t: (key: LocaleKey) => string,
+): MetricOption[] {
+  if (options.some((option) => option.value === selected)) return options;
+  return [
+    ...options,
+    {
       value: selected,
       label: selected === "credits" ? t("CreditsLabel") : selected,
-    });
-  }
-
-  return options;
+    },
+  ];
 }
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.test.tsx
new file mode 100644
index 0000000000..1b95267446
--- /dev/null
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.test.tsx
@@ -0,0 +1,53 @@
+import { fireEvent, render, screen } from "@testing-library/react";
+import { describe, expect, it, vi } from "vitest";
+import {
+  isGatewayProviderId,
+  WayfinderGatewaySection,
+  type GatewayProviderId,
+} from "./WayfinderGatewaySection";
+
+function renderSection(providerId: GatewayProviderId, onSave = vi.fn()) {
+  render(
+    <WayfinderGatewaySection
+      providerId={providerId}
+      draft="https://gateway.example.com"
+      error={null}
+      busy={false}
+      disabled={false}
+      onDraftChange={vi.fn()}
+      onSave={onSave}
+      t={(key) => key}
+    />,
+  );
+  return onSave;
+}
+
+describe("WayfinderGatewaySection", () => {
+  it.each([
+    ["wayfinder", "WayfinderGatewayTitle", "WayfinderGatewayLabel", "WayfinderGatewayHelp"],
+    ["bifrost", "BifrostGatewayTitle", "WayfinderGatewayLabel", "BifrostGatewayHelp"],
+    ["aixy", "AixyGatewayTitle", "AixyGatewayLabel", "AixyGatewayHelp"],
+  ] as const)("uses localized %s copy", (providerId, title, label, help) => {
+    renderSection(providerId);
+
+    expect(screen.getByRole("heading", { name: title })).toBeInTheDocument();
+    expect(screen.getByLabelText(label)).toHaveValue("https://gateway.example.com");
+    expect(screen.getByText(help)).toBeInTheDocument();
+  });
+
+  it("saves through the shared button", () => {
+    const onSave = renderSection("aixy");
+
+    fireEvent.click(screen.getByRole("button", { name: "Save" }));
+
+    expect(onSave).toHaveBeenCalledTimes(1);
+  });
+
+  it("recognizes only gateway providers", () => {
+    expect(isGatewayProviderId("aixy")).toBe(true);
+    expect(isGatewayProviderId("bifrost")).toBe(true);
+    expect(isGatewayProviderId("wayfinder")).toBe(true);
+    expect(isGatewayProviderId("codex")).toBe(false);
+    expect(isGatewayProviderId("toString")).toBe(false);
+  });
+});
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
index 77b4067771..9c454f0ae1 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/WayfinderGatewaySection.tsx
@@ -1,6 +1,37 @@
 import type { LocaleKey } from "../../../../i18n/keys";
 
+export type GatewayProviderId = "wayfinder" | "bifrost" | "aixy";
+
+interface GatewayCopy {
+  title: LocaleKey;
+  label: LocaleKey;
+  help: LocaleKey;
+}
+
+const GATEWAY_COPY: Record<GatewayProviderId, GatewayCopy> = {
+  wayfinder: {
+    title: "WayfinderGatewayTitle",
+    label: "WayfinderGatewayLabel",
+    help: "WayfinderGatewayHelp",
+  },
+  bifrost: {
+    title: "BifrostGatewayTitle",
+    label: "WayfinderGatewayLabel",
+    help: "BifrostGatewayHelp",
+  },
+  aixy: {
+    title: "AixyGatewayTitle",
+    label: "AixyGatewayLabel",
+    help: "AixyGatewayHelp",
+  },
+};
+
+export function isGatewayProviderId(id: string): id is GatewayProviderId {
+  return Object.prototype.hasOwnProperty.call(GATEWAY_COPY, id);
+}
+
 interface Props {
+  providerId: GatewayProviderId;
   draft: string;
   error: string | null;
   busy: boolean;
@@ -8,10 +39,10 @@ interface Props {
   onDraftChange: (draft: string) => void;
   onSave: () => void;
   t: (key: LocaleKey) => string;
-  bifrost?: boolean;
 }
 
 export function WayfinderGatewaySection({
+  providerId,
   draft,
   error,
   busy,
@@ -19,13 +50,13 @@ export function WayfinderGatewaySection({
   onDraftChange,
   onSave,
   t,
-  bifrost = false,
 }: Props) {
+  const copy = GATEWAY_COPY[providerId];
   return (
     <section className="provider-detail__section">
-      <h3>{bifrost ? "Bifrost gateway" : t("WayfinderGatewayTitle")}</h3>
+      <h3>{t(copy.title)}</h3>
       <label>
-        <span>{bifrost ? "Gateway URL" : t("WayfinderGatewayLabel")}</span>
+        <span>{t(copy.label)}</span>
         <input
           type="url"
           value={draft}
@@ -34,9 +65,7 @@ export function WayfinderGatewaySection({
           aria-describedby="wayfinder-gateway-help"
         />
       </label>
-      <p id="wayfinder-gateway-help">
-        {bifrost ? "Base URL of your Bifrost gateway." : t("WayfinderGatewayHelp")}
-      </p>
+      <p id="wayfinder-gateway-help">{t(copy.help)}</p>
       {error && <p role="alert">{error}</p>}
       <button
         type="button"
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts b/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
index 57ab1c71d5..c1db2194d3 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/usageSourcePolicy.ts
@@ -65,6 +65,12 @@ const POLICIES: Readonly<Record<string, UsageSourcePolicy>> = {
       { value: "oauth", label: "API", description: "Uses the configured Bifrost gateway and virtual key only." },
     ],
   },
+  aixy: {
+    options: [
+      { value: "auto", label: "Auto", description: "Uses the configured Aixy API key." },
+      { value: "oauth", label: "API", description: "Uses the configured Aixy API key only." },
+    ],
+  },
   muse: {
     options: [
       { value: "auto", label: "Auto", description: "Uses the local Muse Code device login." },
diff --git a/apps/desktop-tauri/src/test/providerCatalog.ts b/apps/desktop-tauri/src/test/providerCatalog.ts
index 1b1802bc57..19adb0f0aa 100644
--- a/apps/desktop-tauri/src/test/providerCatalog.ts
+++ b/apps/desktop-tauri/src/test/providerCatalog.ts
@@ -79,4 +79,5 @@ export const TEST_PROVIDER_CATALOG: Array<[string, string]> = [
   ["hyper", "Charm Hyper"],
   ["gitkraken", "GitKraken AI"],
   ["bifrost", "Bifrost"],
+  ["aixy", "Aixy"],
 ];
diff --git a/docs/PROVIDERS.md b/docs/PROVIDERS.md
index 237f7dab3d..40406eb21b 100644
--- a/docs/PROVIDERS.md
+++ b/docs/PROVIDERS.md
@@ -55,6 +55,30 @@ spend and, when the optional balance request succeeds, prepaid credit balance.
 It keeps those values in the cost/detail surfaces and does not invent a quota
 percentage or use a Replicate API token as a website credential.
 
+## API-key gateway providers
+
+### Aixy
+
+Aixy reports the API key's own usage and the budgets that apply to it
+(`GET {base}/v1/usage`, `Authorization: Bearer <key>`). Configure the key in
+Settings → Providers → Aixy (or a token account, or `AIXY_API_KEY`). Leave the
+Base URL empty for `https://api.aixy-gateway.com`; set it (or `AIXY_BASE_URL`)
+for a self-hosted gateway. A trailing `/v1` and path prefix are accepted; HTTPS
+is required except for localhost, private-network and `.local` hosts, and a
+Base URL with embedded credentials, a query or a fragment is rejected. Redirects
+are never followed and response bodies are never echoed in errors.
+
+- Hard budgets come first; the two most-utilised known budgets fill the primary
+  and secondary lanes and every other budget is a named window. Overlapping
+  budgets are never summed. Unknown balances show as Unavailable.
+- Details show the key, project and observation time, each applicable budget,
+  and the last seven days of requests, tokens, attributed spend and coverage.
+  Attributed spend is the provider cost; it is not an invoice.
+- Only the Automatic menu-bar metric is offered.
+- A response that fails the `key.usage` contract (wrong currency, another key's
+  budget, inconsistent coverage, malformed amounts) is a parse error, not a
+  partial balance.
+
 ## Listing what is enabled
 
 ```powershell
diff --git a/rust/src/core/provider.rs b/rust/src/core/provider.rs
index 868b66fde6..b5259732f9 100755
--- a/rust/src/core/provider.rs
+++ b/rust/src/core/provider.rs
@@ -95,6 +95,7 @@ pub enum ProviderId {
     Hyper,
     GitKraken,
     Bifrost,
+    Aixy,
 }
 
 impl ProviderId {
@@ -183,6 +184,7 @@ impl ProviderId {
             ProviderId::Hyper,
             ProviderId::GitKraken,
             ProviderId::Bifrost,
+            ProviderId::Aixy,
         ]
     }
 
@@ -233,6 +235,7 @@ impl ProviderId {
             ProviderId::Hyper => "hyper",
             ProviderId::GitKraken => "gitkraken",
             ProviderId::Bifrost => "bifrost",
+            ProviderId::Aixy => "aixy",
             ProviderId::AiAnd => "aiand",
             ProviderId::Windsurf => "windsurf",
             ProviderId::Manus => "manus",
@@ -322,6 +325,7 @@ impl ProviderId {
             ProviderId::Hyper => "Charm Hyper",
             ProviderId::GitKraken => "GitKraken AI",
             ProviderId::Bifrost => "Bifrost",
+            ProviderId::Aixy => "Aixy",
             ProviderId::AiAnd => "ai&",
             ProviderId::Windsurf => "Windsurf",
             ProviderId::Manus => "Manus",
@@ -426,6 +430,7 @@ impl ProviderId {
             ProviderId::Hyper => Some("hyper.charm.land"),
             ProviderId::GitKraken => None,
             ProviderId::Bifrost => None,
+            ProviderId::Aixy => None,
             ProviderId::AiAnd => None,
             ProviderId::Windsurf => None,
             ProviderId::Doubao => None,
@@ -508,6 +513,7 @@ impl ProviderId {
             "hyper" | "charm-hyper" | "charm hyper" => Some(ProviderId::Hyper),
             "gitkraken" | "gitkraken-ai" | "gitkraken ai" => Some(ProviderId::GitKraken),
             "bifrost" | "bifrost-gateway" | "bifrost gateway" => Some(ProviderId::Bifrost),
+            "aixy" | "aixy-gateway" | "aixy gateway" => Some(ProviderId::Aixy),
             "meta" | "metaspark" | "meta-spark" | "muse-spark" | "musespark" | "muse spark"
             | "meta muse spark" => Some(ProviderId::Meta),
             "aiand" | "ai&" | "ai-and" | "ai and" => Some(ProviderId::AiAnd),
@@ -1120,6 +1126,7 @@ pub fn brand_color(id: ProviderId) -> &'static str {
         ProviderId::Hyper => "#7C3AED",
         ProviderId::GitKraken => "#179287",
         ProviderId::Bifrost => "#5B7CFA",
+        ProviderId::Aixy => "#123650",
     }
 }
 
@@ -1134,7 +1141,7 @@ mod tests {
     #[test]
     fn test_provider_id_all() {
         let all = ProviderId::all();
-        assert_eq!(all.len(), 82);
+        assert_eq!(all.len(), 83);
         assert!(all.contains(&ProviderId::Claude));
         assert!(all.contains(&ProviderId::Codex));
         assert!(all.contains(&ProviderId::Pi));
@@ -1197,6 +1204,7 @@ mod tests {
         assert!(all.contains(&ProviderId::Hyper));
         assert!(all.contains(&ProviderId::GitKraken));
         assert!(all.contains(&ProviderId::Bifrost));
+        assert!(all.contains(&ProviderId::Aixy));
     }
 
     #[test]
diff --git a/rust/src/core/provider_factory.rs b/rust/src/core/provider_factory.rs
index 747763d4be..a75cb75ecb 100644
--- a/rust/src/core/provider_factory.rs
+++ b/rust/src/core/provider_factory.rs
@@ -7,22 +7,23 @@
 
 use super::{Provider, ProviderId};
 use crate::providers::{
-    AbacusProvider, AiAndProvider, AlibabaProvider, AlibabaTokenPlanProvider, AmpProvider,
-    AntigravityProvider, AugmentProvider, AzureOpenAIProvider, BedrockProvider, BifrostProvider,
-    ChutesProvider, ClaudeProvider, ClinePassProvider, CodeBuddyProvider, CodeRabbitProvider,
-    CodebuffProvider, CodexProvider, CommandCodeProvider, CopilotProvider, CrossModelProvider,
-    CursorProvider, DeepInfraProvider, DeepSeekProvider, DeepgramProvider, DevinProvider,
-    DoubaoProvider, ElevenLabsProvider, FactoryProvider, FireworksProvider, GeminiProvider,
-    GitKrakenProvider, GrokProvider, GroqProvider, HelmcodeProvider, HuggingFaceProvider,
-    HyperProvider, InfiniProvider, JetBrainsProvider, KiloProvider, KimiK2Provider, KimiProvider,
-    KiroProvider, LLMProxyProvider, LiteLLMProvider, LongCatProvider, ManusProvider, MetaProvider,
-    MiMoProvider, MiniMaxProvider, MistralProvider, MuseProvider, NanoGPTProvider,
-    NeuralwattProvider, NotionProvider, NousProvider, OllamaProvider, OpenAIApiProvider,
-    OpenCodeGoProvider, OpenCodeProvider, OpenRouterProvider, PerplexityProvider, PiProvider,
-    PoeProvider, QoderProvider, QwenCloudProvider, ReplicateProvider, SakanaProvider,
-    StepFunProvider, Sub2ApiProvider, T3ChatProvider, TypeSafeProvider, V0Provider, VeniceProvider,
-    VertexAIProvider, WarpProvider, WayfinderProvider, WindsurfProvider, XaiProvider, ZaiProvider,
-    ZedProvider, ZenMuxProvider, ZoomMateProvider,
+    AbacusProvider, AiAndProvider, AixyProvider, AlibabaProvider, AlibabaTokenPlanProvider,
+    AmpProvider, AntigravityProvider, AugmentProvider, AzureOpenAIProvider, BedrockProvider,
+    BifrostProvider, ChutesProvider, ClaudeProvider, ClinePassProvider, CodeBuddyProvider,
+    CodeRabbitProvider, CodebuffProvider, CodexProvider, CommandCodeProvider, CopilotProvider,
+    CrossModelProvider, CursorProvider, DeepInfraProvider, DeepSeekProvider, DeepgramProvider,
+    DevinProvider, DoubaoProvider, ElevenLabsProvider, FactoryProvider, FireworksProvider,
+    GeminiProvider, GitKrakenProvider, GrokProvider, GroqProvider, HelmcodeProvider,
+    HuggingFaceProvider, HyperProvider, InfiniProvider, JetBrainsProvider, KiloProvider,
+    KimiK2Provider, KimiProvider, KiroProvider, LLMProxyProvider, LiteLLMProvider, LongCatProvider,
+    ManusProvider, MetaProvider, MiMoProvider, MiniMaxProvider, MistralProvider, MuseProvider,
+    NanoGPTProvider, NeuralwattProvider, NotionProvider, NousProvider, OllamaProvider,
+    OpenAIApiProvider, OpenCodeGoProvider, OpenCodeProvider, OpenRouterProvider,
+    PerplexityProvider, PiProvider, PoeProvider, QoderProvider, QwenCloudProvider,
+    ReplicateProvider, SakanaProvider, StepFunProvider, Sub2ApiProvider, T3ChatProvider,
+    TypeSafeProvider, V0Provider, VeniceProvider, VertexAIProvider, WarpProvider,
+    WayfinderProvider, WindsurfProvider, XaiProvider, ZaiProvider, ZedProvider, ZenMuxProvider,
+    ZoomMateProvider,
 };
 
 /// Instantiate the concrete [`Provider`] implementation for a given [`ProviderId`].
@@ -113,6 +114,7 @@ pub fn instantiate(id: ProviderId) -> Box<dyn Provider> {
         ProviderId::Hyper => Box::new(HyperProvider::new()),
         ProviderId::GitKraken => Box::new(GitKrakenProvider::new()),
         ProviderId::Bifrost => Box::new(BifrostProvider::new()),
+        ProviderId::Aixy => Box::new(AixyProvider::new()),
     }
 }
 
diff --git a/rust/src/core/token_accounts.rs b/rust/src/core/token_accounts.rs
index 2b86ad8181..e747bf8e92 100755
--- a/rust/src/core/token_accounts.rs
+++ b/rust/src/core/token_accounts.rs
@@ -320,6 +320,17 @@ impl TokenAccountSupport {
                 requires_manual_cookie_source: false,
                 cookie_name: None,
             }),
+            // Upstream 0.67: labeled Aixy API keys via token accounts.
+            ProviderId::Aixy => Some(TokenAccountSupport {
+                title: "API keys",
+                subtitle: "Store multiple Aixy API keys.",
+                placeholder: "Paste Aixy API key…",
+                injection: TokenInjection::Environment {
+                    key: "AIXY_API_KEY".to_string(),
+                },
+                requires_manual_cookie_source: false,
+                cookie_name: None,
+            }),
             ProviderId::Copilot => Some(TokenAccountSupport {
                 title: "GitHub accounts",
                 subtitle: "Store GitHub OAuth tokens for Copilot plan usage.",
@@ -803,6 +814,19 @@ mod tests {
         assert!(!TokenAccountSupport::is_supported(ProviderId::Bifrost));
     }
 
+    #[test]
+    fn aixy_token_accounts_inject_api_key_env() {
+        let support = TokenAccountSupport::for_provider(ProviderId::Aixy).unwrap();
+        assert_eq!(support.title, "API keys");
+        assert_eq!(support.placeholder, "Paste Aixy API key…");
+        assert!(!support.requires_manual_cookie_source);
+        let env = TokenAccountSupport::env_override(ProviderId::Aixy, "gak_fixture").unwrap();
+        assert_eq!(
+            env.get("AIXY_API_KEY").map(String::as_str),
+            Some("gak_fixture")
+        );
+    }
+
     #[test]
     fn grok_token_accounts_route_bearer_and_cookie_credentials() {
         let bearer =
diff --git a/rust/src/locale.rs b/rust/src/locale.rs
index 276a31160e..c5720bbe0f 100644
--- a/rust/src/locale.rs
+++ b/rust/src/locale.rs
@@ -286,6 +286,11 @@ locale_keys! {
     WayfinderGatewayLabel,
     WayfinderGatewayHelp,
     WayfinderGatewayStatus,
+    BifrostGatewayTitle,
+    BifrostGatewayHelp,
+    AixyGatewayTitle,
+    AixyGatewayLabel,
+    AixyGatewayHelp,
     WayfinderModels,
     WayfinderRequests,
     WayfinderTokens,
diff --git a/rust/src/locale/en-US.ftl b/rust/src/locale/en-US.ftl
index 53b4453f6d..1db5640767 100644
--- a/rust/src/locale/en-US.ftl
+++ b/rust/src/locale/en-US.ftl
@@ -89,6 +89,11 @@ WayfinderGatewayTitle = Wayfinder Gateway
 WayfinderGatewayLabel = Gateway URL
 WayfinderGatewayHelp = Use HTTP only for localhost or loopback addresses. HTTPS is allowed for remote hosts.
 WayfinderGatewayStatus = Gateway
+BifrostGatewayTitle = Bifrost gateway
+BifrostGatewayHelp = Base URL of your Bifrost gateway.
+AixyGatewayTitle = Aixy gateway
+AixyGatewayLabel = Base URL
+AixyGatewayHelp = Leave empty for the hosted Aixy gateway, or enter the Base URL of a self-hosted one. HTTP is allowed only for localhost, private-network and .local hosts.
 WayfinderModels = Models
 WayfinderRequests = Requests
 WayfinderTokens = Tokens
diff --git a/rust/src/providers/aixy/fixtures/key-usage.json b/rust/src/providers/aixy/fixtures/key-usage.json
new file mode 100644
index 0000000000..baab761a21
--- /dev/null
+++ b/rust/src/providers/aixy/fixtures/key-usage.json
@@ -0,0 +1,134 @@
+{
+  "object": "key.usage",
+  "currency": "USD",
+  "as_of": "2026-09-24T12:00:00+00:00",
+  "key": {
+    "id": "11111111-1111-4111-8111-111111111111",
+    "name": "Developer CLI",
+    "project_id": "22222222-2222-4222-8222-222222222222",
+    "project_name": "Engineering"
+  },
+  "usage": {
+    "window": "7d",
+    "requests": 12,
+    "input_tokens": 1000,
+    "output_tokens": 200,
+    "total_tokens": 1200,
+    "spend_usd": 1.25,
+    "attributed_requests": 10,
+    "estimated_requests": 8,
+    "provider_reported_requests": 1,
+    "reconciled_requests": 1,
+    "partial_requests": 2
+  },
+  "budgets": [
+    {
+      "id": "33333333-3333-4333-8333-333333333333",
+      "object": "cost.personal_budget",
+      "scope": "project",
+      "target_id": "22222222-2222-4222-8222-222222222222",
+      "target_name": "Engineering",
+      "interval": "monthly",
+      "limit_usd": "100",
+      "warning_threshold_percent": 80,
+      "enforcement": "hard",
+      "allocation": "shared",
+      "shared": true,
+      "applies_to": [
+        {
+          "api_key_id": "11111111-1111-4111-8111-111111111111",
+          "api_key_name": "Developer CLI",
+          "project_id": "22222222-2222-4222-8222-222222222222",
+          "project_name": "Engineering",
+          "team_id": null,
+          "team_name": null
+        }
+      ],
+      "spend_usd": "20",
+      "remaining_usd": "80",
+      "utilization_percent": 20,
+      "state": "healthy",
+      "starts_at": "2026-09-01T00:00:00+00:00",
+      "resets_at": "2026-10-01T00:00:00+00:00",
+      "spend_status": "available",
+      "availability": {
+        "status": "available",
+        "spent_usd": "20",
+        "reserved_usd": "10",
+        "remaining_usd": "70"
+      }
+    },
+    {
+      "id": "44444444-4444-4444-8444-444444444444",
+      "object": "cost.personal_budget",
+      "scope": "user",
+      "target_id": "66666666-6666-4666-8666-666666666666",
+      "target_name": "Engineering",
+      "interval": "weekly",
+      "limit_usd": "100",
+      "warning_threshold_percent": 80,
+      "enforcement": "monitor",
+      "allocation": "shared",
+      "shared": false,
+      "applies_to": [
+        {
+          "api_key_id": "11111111-1111-4111-8111-111111111111",
+          "api_key_name": "Developer CLI",
+          "project_id": "22222222-2222-4222-8222-222222222222",
+          "project_name": "Engineering",
+          "team_id": null,
+          "team_name": null
+        }
+      ],
+      "spend_usd": "40",
+      "remaining_usd": "60",
+      "utilization_percent": 40,
+      "state": "healthy",
+      "starts_at": "2026-09-21T00:00:00+00:00",
+      "resets_at": "2026-09-28T00:00:00+00:00",
+      "spend_status": "available",
+      "availability": {
+        "status": "not_enforced",
+        "spent_usd": null,
+        "reserved_usd": null,
+        "remaining_usd": null
+      }
+    },
+    {
+      "id": "55555555-5555-4555-8555-555555555555",
+      "object": "cost.personal_budget",
+      "scope": "organization",
+      "target_id": null,
+      "target_name": "Engineering",
+      "interval": "daily",
+      "limit_usd": "100",
+      "warning_threshold_percent": 80,
+      "enforcement": "hard",
+      "allocation": "shared",
+      "shared": true,
+      "applies_to": [
+        {
+          "api_key_id": "11111111-1111-4111-8111-111111111111",
+          "api_key_name": "Developer CLI",
+          "project_id": "22222222-2222-4222-8222-222222222222",
+          "project_name": "Engineering",
+          "team_id": null,
+          "team_name": null
+        }
+      ],
+      "spend_usd": null,
+      "remaining_usd": null,
+      "utilization_percent": null,
+      "state": "unknown",
+      "starts_at": "2026-09-24T00:00:00+00:00",
+      "resets_at": "2026-09-25T00:00:00+00:00",
+      "spend_status": "unavailable",
+      "availability": {
+        "status": "unavailable",
+        "spent_usd": null,
+        "reserved_usd": null,
+        "remaining_usd": null
+      }
+    }
+  ]
+}
diff --git a/rust/src/providers/aixy/mod.rs b/rust/src/providers/aixy/mod.rs
new file mode 100644
index 0000000000..76d965b9a5
--- /dev/null
+++ b/rust/src/providers/aixy/mod.rs
@@ -0,0 +1,215 @@
+//! Aixy AI gateway: the API key's own usage and applicable budget balances.
+//!
+//! Ported from upstream CodexBar v0.67.0. The key is sent only as a Bearer
+//! token to `GET {base}/v1/usage`; the configured base URL is validated
+//! before the credential is resolved, redirects are never followed, and
+//! response bodies are never echoed in errors.
+
+mod model;
+mod present;
+#[cfg(test)]
+mod tests;
+
+use std::time::Duration;
+
+use async_trait::async_trait;
+use reqwest::{Client, StatusCode, Url};
+
+use crate::core::{
+    FetchContext, Provider, ProviderError, ProviderFetchResult, ProviderId, ProviderMetadata,
+    SourceMode,
+};
+
+const CREDENTIAL_TARGET: &str = "codexbar-aixy";
+const API_KEY_ENV: &str = "AIXY_API_KEY";
+const BASE_URL_ENV: &str = "AIXY_BASE_URL";
+const DEFAULT_BASE_URL: &str = "https://api.aixy-gateway.com";
+const DASHBOARD_URL: &str = "https://dash.aixy-gateway.com";
+const USAGE_PATH: &str = "/v1/usage";
+const REQUEST_TIMEOUT: Duration = Duration::from_secs(15);
+const MAX_RESPONSE_BYTES: usize = 2 * 1024 * 1024;
+
+pub struct AixyProvider {
+    metadata: ProviderMetadata,
+    client: Option<Client>,
+}
+
+impl AixyProvider {
+    pub fn new() -> Self {
+        Self {
+            metadata: ProviderMetadata {
+                id: ProviderId::Aixy,
+                display_name: "Aixy",
+                session_label: "Budget",
+                weekly_label: "Secondary budget",
+                supports_opus: false,
+                supports_credits: false,
+                default_enabled: false,
+                is_primary: false,
+                dashboard_url: Some(DASHBOARD_URL),
+                status_page_url: None,
+                tertiary_label_key: None,
+            },
+            client: crate::core::credentialed_http_client_builder()
+                .timeout(REQUEST_TIMEOUT)
+                // The Bearer credential must never follow a gateway redirect
+                // to another origin.
+                .redirect(reqwest::redirect::Policy::none())
+                .build()
+                .ok(),
+        }
+    }
+
+    async fn fetch_api(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        // Validate the endpoint before touching the keyring or environment so
+        // a malformed or public plain-HTTP gateway never receives the key.
+        let base = ctx
+            .gateway_url
+            .clone()
+            .filter(|url| !url.trim().is_empty())
+            .or_else(|| std::env::var(BASE_URL_ENV).ok())
+            .unwrap_or_else(|| DEFAULT_BASE_URL.to_owned());
+        let url = usage_url(&base)?;
+        let api_key = crate::providers::resolve_api_key(
+            ctx.api_key.as_deref(),
+            CREDENTIAL_TARGET,
+            &[API_KEY_ENV],
+        )?;
+        let client = self.client.as_ref().ok_or_else(|| {
+            ProviderError::Other("Could not create a secure Aixy HTTP client.".into())
+        })?;
+
+        let timeout = Duration::from_secs(ctx.web_timeout.max(1)).min(REQUEST_TIMEOUT);
+        let response = client
+            .get(url)
+            .bearer_auth(api_key)
+            .header("Accept", "application/json")
+            .timeout(timeout)
+            .send()
+            .await?;
+        check_status(response.status())?;
+
+        let bytes = crate::providers::read_bounded_response(response, MAX_RESPONSE_BYTES)
+            .await
+            .map_err(|error| match error {
+                crate::providers::BoundedBodyError::TooLarge => {
+                    ProviderError::Parse("Aixy returned an oversized usage response.".into())
+                }
+                crate::providers::BoundedBodyError::Read(error) => ProviderError::Network(error),
+            })?;
+        let body = std::str::from_utf8(&bytes)
+            .map_err(|_| ProviderError::Parse("Aixy returned non-UTF-8 usage data.".into()))?;
+        let usage = model::parse_key_usage(body)?;
+        Ok(present::build_result(usage))
+    }
+}
+
+impl Default for AixyProvider {
+    fn default() -> Self {
+        Self::new()
+    }
+}
+
+#[async_trait]
+impl Provider for AixyProvider {
+    fn id(&self) -> ProviderId {
+        ProviderId::Aixy
+    }
+
+    fn metadata(&self) -> &ProviderMetadata {
+        &self.metadata
+    }
+
+    async fn fetch_usage(&self, ctx: &FetchContext) -> Result<ProviderFetchResult, ProviderError> {
+        match ctx.source_mode {
+            SourceMode::Auto | SourceMode::OAuth => self.fetch_api(ctx).await,
+            source => Err(ProviderError::UnsupportedSource(source)),
+        }
+    }
+
+    fn available_sources(&self) -> Vec<SourceMode> {
+        vec![SourceMode::Auto, SourceMode::OAuth]
+    }
+}
+
+/// Classify a non-success status without reading or echoing the body.
+fn check_status(status: StatusCode) -> Result<(), ProviderError> {
+    match status {
+        StatusCode::UNAUTHORIZED => Err(ProviderError::AuthRequired),
+        StatusCode::FORBIDDEN => Err(ProviderError::Other(
+            "Aixy denied access to this key's usage.".into(),
+        )),
+        StatusCode::NOT_FOUND => Err(ProviderError::Other(
+            "This Aixy installation does not provide the usage endpoint. Update the gateway or check its Base URL."
+                .into(),
+        )),
+        StatusCode::TOO_MANY_REQUESTS => Err(ProviderError::Other(format!(
+            "Aixy usage request was rate limited (HTTP {status})."
+        ))),
+        status if status.is_server_error() => Err(ProviderError::Other(format!(
+            "Aixy usage service is unavailable (HTTP {status})."
+        ))),
+        status if !status.is_success() => Err(ProviderError::Other(format!(
+            "Aixy usage request failed (HTTP {status})."
+        ))),
+        _ => Ok(()),
+    }
+}
+
+/// Build the usage endpoint from a configured base URL.
+///
+/// Trailing slashes and a trailing `/v1` are removed, any path prefix is kept,
+/// and a scheme-less value is treated as HTTPS. Plain HTTP is accepted only
+/// for localhost, private-network and `.local` hosts.
+fn usage_url(raw: &str) -> Result<Url, ProviderError> {
+    let raw = raw.trim().trim_end_matches('/');
+    if raw.is_empty() {
+        return Err(ProviderError::Other("Aixy Base URL is empty.".into()));
+    }
+    if raw.contains(['?', '#']) {
+        return Err(ProviderError::Other(
+            "Aixy Base URL must not contain a query or fragment.".into(),
+        ));
+    }
+    let candidate = if raw.contains("://") {
+        raw.to_owned()
+    } else {
+        format!("https://{raw}")
+    };
+    let mut url = Url::parse(&candidate)
+        .map_err(|_| ProviderError::Other("Aixy Base URL is invalid.".into()))?;
+    let host = url
+        .host_str()
+        .ok_or_else(|| ProviderError::Other("Aixy Base URL must include a host.".into()))?;
+    if !url.username().is_empty() || url.password().is_some() {
+        return Err(ProviderError::Other(
+            "Aixy Base URL must not contain embedded credentials.".into(),
+        ));
+    }
+    let allowed = match url.scheme() {
+        "https" => true,
+        "http" => crate::providers::is_private_network_host(host) || host.ends_with(".local"),
+        _ => false,
+    };
+    if !allowed {
+        return Err(ProviderError::Other(
+            "Aixy Base URL must use HTTPS; HTTP is allowed only for localhost, private-network or .local hosts."
+                .into(),
+        ));
+    }
+
+    let path = url.path().trim_end_matches('/');
+    let path = path.strip_suffix("/v1").unwrap_or(path);
+    let path = format!("{path}{USAGE_PATH}");
+    url.set_path(&path);
+    Ok(url)
+}
+
+/// Validate a configured Base URL before saving it to settings. An empty value
+/// is valid and selects the hosted gateway.
+pub fn validate_gateway_url(raw: &str) -> Result<(), ProviderError> {
+    if raw.trim().is_empty() {
+        return Ok(());
+    }
+    usage_url(raw).map(|_| ())
+}
diff --git a/rust/src/providers/aixy/model.rs b/rust/src/providers/aixy/model.rs
new file mode 100644
index 0000000000..f17c2916ac
--- /dev/null
+++ b/rust/src/providers/aixy/model.rs
@@ -0,0 +1,411 @@
+//! Aixy `GET /v1/usage` wire model and validation.
+//!
+//! The `key.usage` contract is validated strictly so an unrecognised,
+//! cross-key or internally inconsistent payload can never publish a
+//! misleading balance. Every failure is a generic parse error; response text
+//! is never echoed. Amount and count fields stay as raw JSON until the code
+//! path that needs them validates them, mirroring upstream, which only checks
+//! the branch (hard availability or monitor spend) it actually reads.
+
+use chrono::{DateTime, Utc};
+use serde::Deserialize;
+use serde_json::Value;
+
+use crate::core::ProviderError;
+
+const MAX_BUDGETS: usize = 64;
+const MAX_TEXT_CHARS: usize = 120;
+/// Largest integer JavaScript represents exactly (`Number.MAX_SAFE_INTEGER`).
+const MAX_SAFE_INTEGER: f64 = 9_007_199_254_740_991.0;
+
+#[derive(Deserialize)]
+struct WireRoot {
+    object: Option<String>,
+    currency: Option<String>,
+    as_of: Option<Value>,
+    key: WireKey,
+    budgets: Vec<WireBudget>,
+    usage: Option<WireUsage>,
+}
+
+#[derive(Deserialize)]
+struct WireKey {
+    id: Option<Value>,
+    name: Option<Value>,
+    project_id: Option<Value>,
+    project_name: Option<Value>,
+}
+
+#[derive(Deserialize)]
+struct WireBudget {
+    id: Option<Value>,
+    scope: Option<Value>,
+    interval: Option<Value>,
+    enforcement: Option<String>,
+    shared: Option<bool>,
+    limit_usd: Option<Value>,
+    applies_to: Option<Vec<WireAppliesTo>>,
+    availability: WireAvailability,
+    spend_status: Option<Value>,
+    spend_usd: Option<Value>,
+    remaining_usd: Option<Value>,
+    starts_at: Option<Value>,
+    resets_at: Option<Value>,
+}
+
+#[derive(Deserialize)]
+struct WireAppliesTo {
+    api_key_id: Option<Value>,
+    project_id: Option<Value>,
+}
+
+#[derive(Deserialize)]
+struct WireAvailability {
+    status: Option<Value>,
+    spent_usd: Option<Value>,
+    reserved_usd: Option<Value>,
+    remaining_usd: Option<Value>,
+}
+
+#[derive(Deserialize)]
+struct WireUsage {
+    window: Option<String>,
+    requests: Option<Value>,
+    total_tokens: Option<Value>,
+    attributed_requests: Option<Value>,
+    partial_requests: Option<Value>,
+    spend_usd: Option<Value>,
+}
+
+/// One budget that applies to the reporting key.
+#[derive(Debug, Clone, PartialEq)]
+pub(super) struct Budget {
+    pub id: String,
+    pub title: String,
+    pub known: bool,
+    pub hard: bool,
+    pub spent: Option<f64>,
+    pub reserved: f64,
+    pub remaining: Option<f64>,
+    pub limit: f64,
+    pub used_percent: f64,
+    pub window_minutes: Option<u32>,
+    pub resets_at: Option<DateTime<Utc>>,
+}
+
+/// The key's own last-seven-days totals.
+#[derive(Debug, Clone, PartialEq)]
+pub(super) struct Totals {
+    pub requests: u64,
+    pub total_tokens: u64,
+    pub attributed_requests: u64,
+    pub partial_requests: u64,
+    pub spend_usd: Option<f64>,
+}
+
+#[derive(Debug, Clone, PartialEq)]
+pub(super) struct KeyUsage {
+    pub key_id: String,
+    pub key_label: String,
+    pub project_label: String,
+    pub as_of: DateTime<Utc>,
+    /// Sorted: hard first, known first, higher utilisation first, then id.
+    pub budgets: Vec<Budget>,
+    pub totals: Option<Totals>,
+}
+
+pub(super) fn parse_error(reason: &str) -> ProviderError {
+    ProviderError::Parse(format!(
+        "Aixy returned an unrecognized usage response ({reason})."
+    ))
+}
+
+pub(super) fn parse_key_usage(body: &str) -> Result<KeyUsage, ProviderError> {
+    let root: WireRoot =
+        serde_json::from_str(body).map_err(|_| parse_error("unexpected JSON shape"))?;
+    if root.object.as_deref() != Some("key.usage") || root.currency.as_deref() != Some("USD") {
+        return Err(parse_error("unsupported usage contract"));
+    }
+    let as_of =
+        date(root.as_of.as_ref())?.ok_or_else(|| parse_error("missing observation time"))?;
+    let key_id = text(root.key.id.as_ref())?;
+    if root.budgets.len() > MAX_BUDGETS {
+        return Err(parse_error("too many budgets"));
+    }
+
+    let mut seen = std::collections::HashSet::new();
+    let mut budgets = Vec::with_capacity(root.budgets.len());
+    for wire in &root.budgets {
+        let budget = validate_budget(wire, &root.key, &key_id)?;
+        if !seen.insert(budget.id.clone()) {
+            return Err(parse_error("duplicate budget"));
+        }
+        budgets.push(budget);
+    }
+    budgets.sort_by(|a, b| {
+        b.hard
+            .cmp(&a.hard)
+            .then(b.known.cmp(&a.known))
+            .then(b.used_percent.total_cmp(&a.used_percent))
+            .then_with(|| a.id.cmp(&b.id))
+    });
+
+    let key_label = optional_text(root.key.name.as_ref())?.unwrap_or_else(|| key_id.clone());
+    let project_label = match optional_text(root.key.project_name.as_ref())? {
+        Some(name) => name,
+        None => text(root.key.project_id.as_ref())?,
+    };
+    let totals = root.usage.as_ref().map(validate_totals).transpose()?;
+
+    Ok(KeyUsage {
+        key_label: bounded(&key_label),
+        project_label: bounded(&project_label),
+        key_id,
+        as_of,
+        budgets,
+        totals,
+    })
+}
+
+fn validate_budget(
+    wire: &WireBudget,
+    key: &WireKey,
+    key_id: &str,
+) -> Result<Budget, ProviderError> {
+    let id = text(wire.id.as_ref())?;
+    let scope = text(wire.scope.as_ref())?;
+    let interval = text(wire.interval.as_ref())?;
+    let scope_label = match scope.as_str() {
+        "organization" => "Organization",
+        "project" => "Project",
+        "team" => "Team",
+        "user" => "User",
+        "api_key" => "Key",
+        _ => return Err(parse_error("invalid budget scope or interval")),
+    };
+    let interval_label = match interval.as_str() {
+        "daily" => "Daily",
+        "weekly" => "Weekly",
+        "monthly" => "Monthly",
+        "lifetime" => "Lifetime",
+        _ => return Err(parse_error("invalid budget scope or interval")),
+    };
+    let hard = match wire.enforcement.as_deref() {
+        Some("hard") => true,
+        Some("monitor") => false,
+        _ => return Err(parse_error("invalid enforcement")),
+    };
+    let shared = wire
+        .shared
+        .ok_or_else(|| parse_error("invalid shared scope"))?;
+    let limit = amount(wire.limit_usd.as_ref())?
+        .filter(|limit| *limit > 0.0)
+        .ok_or_else(|| parse_error("invalid budget limit"))?;
+
+    let key_project = key_string(key.project_id.as_ref())?;
+    let applies = wire
+        .applies_to
+        .as_deref()
+        .filter(|items| !items.is_empty())
+        .ok_or_else(|| parse_error("budget belongs to another key"))?;
+    for item in applies {
+        if key_string(item.api_key_id.as_ref())?.as_deref() != Some(key_id)
+            || key_string(item.project_id.as_ref())? != key_project
+        {
+            return Err(parse_error("budget belongs to another key"));
+        }
+    }
+
+    let availability = &wire.availability;
+    let status = text(availability.status.as_ref())?;
+    if !matches!(
+        status.as_str(),
+        "available" | "unavailable" | "not_enforced"
+    ) {
+        return Err(parse_error("invalid availability"));
+    }
+    let spend_status = text(wire.spend_status.as_ref())?;
+    if !matches!(spend_status.as_str(), "available" | "unavailable") {
+        return Err(parse_error("invalid spend status"));
+    }
+    let known = if hard {
+        status == "available"
+    } else {
+        spend_status == "available"
+    };
+    let (spent, reserved, remaining) = if hard {
+        (
+            amount(availability.spent_usd.as_ref())?,
+            amount(availability.reserved_usd.as_ref())?,
+            amount(availability.remaining_usd.as_ref())?,
+        )
+    } else {
+        (
+            amount(wire.spend_usd.as_ref())?,
+            Some(0.0),
+            amount(wire.remaining_usd.as_ref())?,
+        )
+    };
+    let used = if known {
+        let (Some(spent), Some(reserved), Some(_)) = (spent, reserved, remaining) else {
+            return Err(parse_error("incomplete budget balance"));
+        };
+        let used = spent + reserved;
+        if !used.is_finite() {
+            return Err(parse_error("budget amount overflow"));
+        }
+        Some(used)
+    } else {
+        None
+    };
+
+    let starts_at = date(wire.starts_at.as_ref())?;
+    let resets_at = date(wire.resets_at.as_ref())?;
+    if let (Some(starts), Some(resets)) = (starts_at, resets_at)
+        && resets <= starts
+    {
+        return Err(parse_error("invalid budget period"));
+    }
+    let window_minutes = starts_at.zip(resets_at).and_then(|(starts, resets)| {
+        let millis = (resets - starts).num_milliseconds();
+        (millis > 0 && millis % 60_000 == 0)
+            .then(|| u32::try_from(millis / 60_000).ok())
+            .flatten()
+    });
+
+    let title = bounded(&format!(
+        "{scope_label} · {interval_label} · {} · {}",
+        if shared { "Shared" } else { "Personal" },
+        if hard { "Hard" } else { "Monitor" },
+    ));
+    Ok(Budget {
+        id,
+        title,
+        known,
+        hard,
+        spent,
+        reserved: reserved.unwrap_or(0.0),
+        remaining,
+        limit,
+        used_percent: used.map_or(0.0, |used| percent(used, limit)),
+        window_minutes,
+        resets_at,
+    })
+}
+
+fn validate_totals(wire: &WireUsage) -> Result<Totals, ProviderError> {
+    if wire.window.as_deref() != Some("7d") {
+        return Err(parse_error("unsupported reporting period"));
+    }
+    let requests = count(wire.requests.as_ref())?;
+    let total_tokens = count(wire.total_tokens.as_ref())?;
+    let attributed_requests = count(wire.attributed_requests.as_ref())?;
+    let partial_requests = count(wire.partial_requests.as_ref())?;
+    let spend_usd = amount(wire.spend_usd.as_ref())?;
+    if attributed_requests > requests
+        || partial_requests > attributed_requests
+        || spend_usd.is_some_and(|spend| spend > 0.0 && attributed_requests == 0)
+    {
+        return Err(parse_error("invalid attribution coverage"));
+    }
+    Ok(Totals {
+        requests,
+        total_tokens,
+        attributed_requests,
+        partial_requests,
+        spend_usd,
+    })
+}
+
+/// A required, non-blank string, trimmed.
+fn text(value: Option<&Value>) -> Result<String, ProviderError> {
+    match value {
+        Some(Value::String(text)) if !text.trim().is_empty() => Ok(text.trim().to_owned()),
+        _ => Err(parse_error("invalid text")),
+    }
+}
+
+/// Absent or null is `None`; anything else must be a valid non-blank string.
+fn optional_text(value: Option<&Value>) -> Result<Option<String>, ProviderError> {
+    match value {
+        None | Some(Value::Null) => Ok(None),
+        value => text(value).map(Some),
+    }
+}
+
+/// Raw identifier comparison value: absent and null are equivalent.
+fn key_string(value: Option<&Value>) -> Result<Option<String>, ProviderError> {
+    match value {
+        None | Some(Value::Null) => Ok(None),
+        Some(Value::String(text)) => Ok(Some(text.clone())),
+        Some(_) => Err(parse_error("invalid identifier")),
+    }
+}
+
+/// A finite, non-negative number, or a decimal string (`^\d+(\.\d+)?$`).
+/// Absent and null are `None`.
+fn amount(value: Option<&Value>) -> Result<Option<f64>, ProviderError> {
+    let parsed = match value {
+        None | Some(Value::Null) => return Ok(None),
+        Some(Value::Number(number)) => number.as_f64(),
+        Some(Value::String(text)) if is_decimal(text) => text.parse::<f64>().ok(),
+        Some(_) => None,
+    };
+    parsed
+        .filter(|value| value.is_finite() && *value >= 0.0)
+        .map(Some)
+        .ok_or_else(|| parse_error("invalid amount"))
+}
+
+fn is_decimal(text: &str) -> bool {
+    let (whole, fraction) = match text.split_once('.') {
+        Some((whole, fraction)) => (whole, Some(fraction)),
+        None => (text, None),
+    };
+    let digits = |part: &str| !part.is_empty() && part.bytes().all(|b| b.is_ascii_digit());
+    digits(whole) && fraction.is_none_or(digits)
+}
+
+/// A required amount that must also be a safe integer.
+fn count(value: Option<&Value>) -> Result<u64, ProviderError> {
+    match amount(value)? {
+        Some(value) if value.fract() == 0.0 && value <= MAX_SAFE_INTEGER =>
+        {
+            #[allow(
+                clippy::cast_possible_truncation,
+                clippy::cast_sign_loss,
+                reason = "value is a non-negative integer no larger than 2^53 - 1"
+            )]
+            Ok(value as u64)
+        }
+        _ => Err(parse_error("invalid count")),
+    }
+}
+
+/// Absent or null is `None`; otherwise an RFC 3339 timestamp.
+fn date(value: Option<&Value>) -> Result<Option<DateTime<Utc>>, ProviderError> {
+    if matches!(value, None | Some(Value::Null)) {
+        return Ok(None);
+    }
+    let raw = text(value).map_err(|_| parse_error("invalid date"))?;
+    DateTime::parse_from_rfc3339(&raw)
+        .map(|date| Some(date.with_timezone(&Utc)))
+        .map_err(|_| parse_error("invalid date"))
+}
+
+fn percent(used: f64, limit: f64) -> f64 {
+    if used.is_finite() && limit.is_finite() && limit > 0.0 {
+        (used / limit * 100.0).clamp(0.0, 100.0)
+    } else {
+        0.0
+    }
+}
+
+/// Bound provider-supplied display text and strip control characters.
+pub(super) fn bounded(value: &str) -> String {
+    value
+        .chars()
+        .filter(|c| !c.is_control())
+        .take(MAX_TEXT_CHARS)
+        .collect()
+}
diff --git a/rust/src/providers/aixy/present.rs b/rust/src/providers/aixy/present.rs
new file mode 100644
index 0000000000..be49923ef9
--- /dev/null
+++ b/rust/src/providers/aixy/present.rs
@@ -0,0 +1,173 @@
+//! Map a validated Aixy key-usage response onto the shared provider result.
+
+use chrono::SecondsFormat;
+
+use super::model::{Budget, KeyUsage, Totals};
+use crate::core::{
+    CostSnapshot, NamedRateWindow, ProviderDisplayDetail, ProviderFetchResult, RateWindow,
+    UsageSnapshot,
+};
+
+const COST_PERIOD: &str = "Last 7 days · attributed";
+const LOGIN_METHOD: &str = "API key";
+
+pub(super) fn build_result(usage: KeyUsage) -> ProviderFetchResult {
+    // Overlapping budgets are never summed: only the two most utilised known
+    // budgets take the primary/secondary lanes; the rest stay visible as
+    // named windows.
+    let selected = usage
+        .budgets
+        .iter()
+        .filter(|budget| budget.known)
+        .take(2)
+        .map(|budget| budget.id.as_str())
+        .collect::<Vec<_>>();
+
+    let mut windows = selected
+        .iter()
+        .filter_map(|id| usage.budgets.iter().find(|budget| budget.id == *id))
+        .map(rate_window);
+    let primary = windows.next().unwrap_or_else(|| {
+        RateWindow::informational(if usage.budgets.is_empty() {
+            "No applicable budgets reported"
+        } else {
+            "Budget balance unavailable"
+        })
+    });
+    let secondary = windows.next();
+
+    let mut snapshot = UsageSnapshot::new(primary).with_login_method(LOGIN_METHOD);
+    if let Some(secondary) = secondary {
+        snapshot = snapshot.with_secondary(secondary);
+    }
+    for budget in usage
+        .budgets
+        .iter()
+        .filter(|budget| !selected.contains(&budget.id.as_str()))
+    {
+        snapshot.extra_rate_windows.push(
+            NamedRateWindow::new(
+                format!("aixy-{}", budget.id),
+                budget.title.clone(),
+                rate_window(budget),
+            )
+            .with_usage_known(budget.known),
+        );
+    }
+
+    let mut result = ProviderFetchResult::new(snapshot, "api").with_account_identity(&usage.key_id);
+    if let Some(spend) = usage.totals.as_ref().and_then(|totals| totals.spend_usd) {
+        result = result.with_cost(CostSnapshot::new(spend, "USD", COST_PERIOD));
+    }
+    for detail in details(&usage) {
+        result = result.with_display_detail(detail);
+    }
+    result
+}
+
+fn rate_window(budget: &Budget) -> RateWindow {
+    let balance = match (budget.known, budget.remaining) {
+        (true, Some(remaining)) => format!("{} remaining", usd(remaining)),
+        _ => "Unavailable".to_owned(),
+    };
+    RateWindow::with_details(
+        budget.used_percent,
+        budget.window_minutes,
+        budget.resets_at,
+        Some(format!("{} · {balance}", budget.title)),
+    )
+    .with_usage_known(budget.known)
+}
+
+fn details(usage: &KeyUsage) -> Vec<Option<ProviderDisplayDetail>> {
+    let mut rows = vec![
+        ProviderDisplayDetail::new("key", "Key", &usage.key_label),
+        ProviderDisplayDetail::new("project", "Project", &usage.project_label),
+        ProviderDisplayDetail::new(
+            "observed",
+            "Observed",
+            usage.as_of.to_rfc3339_opts(SecondsFormat::Millis, true),
+        ),
+    ];
+    rows.extend(usage.budgets.iter().enumerate().map(budget_row));
+    match &usage.totals {
+        Some(totals) => rows.extend(totals_rows(totals)),
+        None => rows.push(ProviderDisplayDetail::new(
+            "usage-7d",
+            "Usage (last 7 days)",
+            "Unavailable",
+        )),
+    }
+    rows
+}
+
+fn budget_row((index, budget): (usize, &Budget)) -> Option<ProviderDisplayDetail> {
+    let id = format!("budget-{index}");
+    let (Some(remaining), Some(spent), true) = (budget.remaining, budget.spent, budget.known)
+    else {
+        return ProviderDisplayDetail::new(id, &budget.title, "Unavailable");
+    };
+    let spent = if budget.hard {
+        format!("{} spent · {} reserved", usd(spent), usd(budget.reserved))
+    } else {
+        format!("{} spent", usd(spent))
+    };
+    ProviderDisplayDetail::new(
+        id,
+        &budget.title,
+        format!("{} / {} remaining", usd(remaining), usd(budget.limit)),
+    )
+    .and_then(|row| row.with_secondary_value(spent))
+    .and_then(|row| row.with_progress(budget.used_percent, 100.0))
+}
+
+fn totals_rows(totals: &Totals) -> Vec<Option<ProviderDisplayDetail>> {
+    vec![
+        ProviderDisplayDetail::new(
+            "requests-7d",
+            "Requests (last 7 days)",
+            count(totals.requests),
+        ),
+        ProviderDisplayDetail::new(
+            "tokens-7d",
+            "Tokens (last 7 days)",
+            count(totals.total_tokens),
+        ),
+        ProviderDisplayDetail::new(
+            "spend-7d",
+            "Attributed spend (last 7 days)",
+            totals
+                .spend_usd
+                .map_or_else(|| "Unavailable".to_owned(), usd),
+        ),
+        ProviderDisplayDetail::new(
+            "coverage-7d",
+            "Cost coverage (last 7 days)",
+            format!(
+                "{} / {} requests",
+                count(totals.attributed_requests),
+                count(totals.requests)
+            ),
+        )
+        .and_then(|row| {
+            row.with_secondary_value(format!("{} partial", count(totals.partial_requests)))
+        }),
+    ]
+}
+
+fn usd(value: f64) -> String {
+    format!("${value:.2}")
+}
+
+/// Integer with thousands separators.
+fn count(value: u64) -> String {
+    let digits = value.to_string();
+    let mut grouped = String::with_capacity(digits.len() + digits.len() / 3);
+    for (index, digit) in digits.chars().enumerate() {
+        if index > 0 && (digits.len() - index).is_multiple_of(3) {
+            grouped.push(',');
+        }
+        grouped.push(digit);
+    }
+    grouped
+}
diff --git a/rust/src/providers/aixy/tests.rs b/rust/src/providers/aixy/tests.rs
new file mode 100644
index 0000000000..72175225b8
--- /dev/null
+++ b/rust/src/providers/aixy/tests.rs
@@ -0,0 +1,504 @@
+use super::*;
+use crate::core::ProviderDisplayDetail;
+use mockito::Matcher;
+use serde_json::{Value, json};
+
+const FIXTURE: &str = include_str!("fixtures/key-usage.json");
+const API_KEY: &str = "gak_fixture";
+const KEY_ID: &str = "11111111-1111-4111-8111-111111111111";
+
+fn body() -> Value {
+    serde_json::from_str(FIXTURE).unwrap()
+}
+
+fn result(body: &Value) -> Result<ProviderFetchResult, ProviderError> {
+    model::parse_key_usage(&body.to_string()).map(present::build_result)
+}
+
+fn assert_parse_error(body: &Value) {
+    match result(body) {
+        Err(ProviderError::Parse(message)) => {
+            assert!(message.starts_with("Aixy returned"), "{message}");
+        }
+        other => panic!("expected a parse failure, got {other:?}"),
+    }
+}
+
+fn context(base: &str) -> FetchContext {
+    FetchContext {
+        gateway_url: Some(base.to_owned()),
+        api_key: Some(API_KEY.to_owned()),
+        ..FetchContext::default()
+    }
+}
+
+fn detail<'a>(result: &'a ProviderFetchResult, id: &str) -> &'a ProviderDisplayDetail {
+    result
+        .display_details()
+        .iter()
+        .find(|row| row.id() == id)
+        .unwrap_or_else(|| panic!("missing detail row {id}"))
+}
+
+#[test]
+fn key_usage_keeps_overlapping_budgets_and_reservations_separate() {
+    let result = result(&body()).unwrap();
+    let usage = &result.usage;
+
+    assert_eq!(usage.primary.used_percent, 30.0);
+    assert_eq!(usage.primary.window_minutes, Some(43_200));
+    let secondary = usage.secondary.as_ref().unwrap();
+    assert_eq!(secondary.used_percent, 40.0);
+    assert_eq!(secondary.window_minutes, Some(10_080));
+    let description = usage.primary.reset_description.as_deref().unwrap();
+    assert!(description.contains("Shared · Hard"), "{description}");
+    assert!(description.contains("$70.00 remaining"), "{description}");
+    assert!(usage.primary.resets_at.is_some());
+
+    assert_eq!(usage.extra_rate_windows.len(), 1);
+    let extra = &usage.extra_rate_windows[0];
+    assert_eq!(
+        extra.id,
+        "aixy-55555555-5555-4555-8555-555555555555".to_owned()
+    );
+    assert!(!extra.usage_known);
+    assert!(!extra.window.usage_known());
+    assert!(extra.window.resets_at.is_some());
+    assert!(
+        extra
+            .window
+            .reset_description
+            .as_deref()
+            .unwrap()
+            .ends_with("Unavailable")
+    );
+
+    let cost = result.cost.as_ref().unwrap();
+    assert_eq!(cost.used, 1.25);
+    assert_eq!(cost.currency_code, "USD");
+    assert_eq!(cost.period, "Last 7 days · attributed");
+
+    assert_eq!(usage.login_method.as_deref(), Some("API key"));
+    assert!(usage.account_email.is_none());
+    assert!(usage.account_organization.is_none());
+    assert_eq!(result.account_identity(), Some(KEY_ID));
+    assert_eq!(result.source_label, "api");
+
+    assert_eq!(detail(&result, "key").value(), "Developer CLI");
+    assert_eq!(detail(&result, "project").value(), "Engineering");
+    assert_eq!(
+        detail(&result, "observed").value(),
+        "2026-09-24T12:00:00.000Z"
+    );
+    let hard = detail(&result, "budget-0");
+    assert_eq!(hard.title(), "Project · Monthly · Shared · Hard");
+    assert_eq!(hard.value(), "$70.00 / $100.00 remaining");
+    assert_eq!(
+        hard.secondary_value(),
+        Some("$20.00 spent · $10.00 reserved")
+    );
+    assert_eq!(hard.progress().unwrap().used(), 30.0);
+    let monitor = detail(&result, "budget-2");
+    assert_eq!(monitor.title(), "User · Weekly · Personal · Monitor");
+    assert_eq!(monitor.secondary_value(), Some("$40.00 spent"));
+    assert_eq!(detail(&result, "budget-1").value(), "Unavailable");
+    assert_eq!(detail(&result, "requests-7d").value(), "12");
+    assert_eq!(detail(&result, "tokens-7d").value(), "1,200");
+    assert_eq!(detail(&result, "spend-7d").value(), "$1.25");
+    let coverage = detail(&result, "coverage-7d");
+    assert_eq!(coverage.value(), "10 / 12 requests");
+    assert_eq!(coverage.secondary_value(), Some("2 partial"));
+}
+
+#[test]
+fn budgets_sort_hard_first_then_known_then_utilization_then_id() {
+    let usage = model::parse_key_usage(FIXTURE).unwrap();
+    let order = usage
+        .budgets
+        .iter()
+        .map(|budget| (budget.hard, budget.known))
+        .collect::<Vec<_>>();
+    assert_eq!(order, [(true, true), (true, false), (false, true)]);
+}
+
+#[test]
+fn absent_budgets_never_become_an_invented_quota() {
+    let mut body = body();
+    body["budgets"] = json!([]);
+    let with_usage = result(&body).unwrap();
+    assert!(with_usage.usage.primary.is_informational);
+    assert_eq!(
+        with_usage.usage.primary.reset_description.as_deref(),
+        Some("No applicable budgets reported")
+    );
+    assert!(with_usage.usage.secondary.is_none());
+    assert_eq!(with_usage.cost.as_ref().unwrap().used, 1.25);
+
+    body["usage"] = Value::Null;
+    let without_usage = result(&body).unwrap();
+    assert!(without_usage.cost.is_none());
+    let rows = without_usage.display_details();
+    assert_eq!(rows.last().unwrap().value(), "Unavailable");
+}
+
+#[test]
+fn all_unknown_budgets_are_listed_without_a_measured_lane() {
+    let mut body = body();
+    let budgets = body["budgets"].as_array_mut().unwrap();
+    budgets.retain(|budget| budget["id"] == "55555555-5555-4555-8555-555555555555");
+    let result = result(&body).unwrap();
+    assert!(result.usage.primary.is_informational);
+    assert_eq!(
+        result.usage.primary.reset_description.as_deref(),
+        Some("Budget balance unavailable")
+    );
+    assert_eq!(result.usage.extra_rate_windows.len(), 1);
+    assert!(!result.usage.extra_rate_windows[0].usage_known);
+}
+
+#[test]
+fn zero_activity_distinguishes_zero_from_unavailable_spend() {
+    let mut body = body();
+    for field in [
+        "requests",
+        "input_tokens",
+        "output_tokens",
+        "total_tokens",
+        "spend_usd",
+        "attributed_requests",
+        "estimated_requests",
+        "provider_reported_requests",
+        "reconciled_requests",
+        "partial_requests",
+    ] {
+        body["usage"][field] = json!(0);
+    }
+    let zero = result(&body).unwrap();
+    assert_eq!(zero.usage.primary.used_percent, 30.0);
+    assert_eq!(zero.cost.as_ref().unwrap().used, 0.0);
+    assert_eq!(detail(&zero, "spend-7d").value(), "$0.00");
+
+    body["usage"]["spend_usd"] = Value::Null;
+    let unavailable = result(&body).unwrap();
+    assert!(unavailable.cost.is_none());
+    assert_eq!(detail(&unavailable, "spend-7d").value(), "Unavailable");
+
+    body["usage"]["spend_usd"] = json!(1);
+    assert_parse_error(&body);
+}
+
+#[test]
+fn invalid_or_cross_key_responses_cannot_publish_misleading_balances() {
+    type Mutation = fn(&mut Value);
+    let cases: [(&str, Mutation); 12] = [
+        ("currency", |b| b["currency"] = json!("EUR")),
+        ("contract", |b| b["object"] = json!("other")),
+        ("key", |b| {
+            b["key"] = json!({ "id": "different-key", "project_id": "different-project" });
+        }),
+        ("amount", |b| b["budgets"][0]["limit_usd"] = json!("NaN")),
+        ("negative", |b| b["budgets"][0]["limit_usd"] = json!(-1)),
+        ("zero limit", |b| b["budgets"][0]["limit_usd"] = json!(0)),
+        ("duplicate", |b| {
+            let first = b["budgets"][0].clone();
+            b["budgets"].as_array_mut().unwrap().push(first);
+        }),
+        ("date", |b| b["budgets"][0]["resets_at"] = json!("invalid")),
+        ("period", |b| {
+            b["budgets"][0]["resets_at"] = b["budgets"][0]["starts_at"].clone();
+        }),
+        ("coverage", |b| {
+            b["usage"]["attributed_requests"] = json!(13)
+        }),
+        ("tokens", |b| b["usage"]["total_tokens"] = json!(1e30)),
+        ("window", |b| b["usage"]["window"] = json!("30d")),
+    ];
+    for (name, mutate) in cases {
+        let mut body = body();
+        mutate(&mut body);
+        match result(&body) {
+            Err(ProviderError::Parse(_)) => {}
+            other => panic!("{name}: expected a parse failure, got {other:?}"),
+        }
+    }
+}
+
+#[test]
+fn other_contract_violations_are_rejected() {
+    type Mutation = fn(&mut Value);
+    let cases: [(&str, Mutation); 9] = [
+        ("scope", |b| b["budgets"][0]["scope"] = json!("galaxy")),
+        ("interval", |b| {
+            b["budgets"][0]["interval"] = json!("hourly")
+        }),
+        ("enforcement", |b| {
+            b["budgets"][0]["enforcement"] = json!("soft")
+        }),
+        ("shared", |b| b["budgets"][0]["shared"] = json!("yes")),
+        ("empty applies_to", |b| {
+            b["budgets"][0]["applies_to"] = json!([])
+        }),
+        ("availability", |b| {
+            b["budgets"][0]["availability"]["status"] = json!("maybe");
+        }),
+        ("spend status", |b| {
+            b["budgets"][0]["spend_status"] = json!("maybe")
+        }),
+        ("as_of", |b| b["as_of"] = json!("yesterday")),
+        ("incomplete balance", |b| {
+            b["budgets"][0]["availability"]["reserved_usd"] = Value::Null;
+        }),
+    ];
+    for (name, mutate) in cases {
+        let mut body = body();
+        mutate(&mut body);
+        match result(&body) {
+            Err(ProviderError::Parse(_)) => {}
+            other => panic!("{name}: expected a parse failure, got {other:?}"),
+        }
+    }
+
+    let mut body = body();
+    let template = body["budgets"][0].clone();
+    body["budgets"] = Value::Array(
+        (0..65)
+            .map(|index| {
+                let mut budget = template.clone();
+                budget["id"] = json!(format!("budget-{index}"));
+                budget
+            })
+            .collect(),
+    );
+    assert_parse_error(&body);
+    body["budgets"].as_array_mut().unwrap().pop();
+    assert_eq!(result(&body).unwrap().usage.extra_rate_windows.len(), 62);
+}
+
+#[test]
+fn only_the_selected_balance_branch_is_validated() {
+    // A monitor budget reads its spend fields; a malformed hard availability
+    // block is ignored, and vice versa.
+    let mut body = body();
+    body["budgets"][1]["availability"]["spent_usd"] = json!("not a number");
+    assert!(result(&body).is_ok());
+    body["budgets"][0]["spend_usd"] = json!("not a number");
+    assert!(result(&body).is_ok());
+}
+
+#[test]
+fn amounts_and_counts_accept_numbers_and_decimal_strings_only() {
+    let mut body = body();
+    body["budgets"][0]["limit_usd"] = json!("100.50");
+    body["usage"]["requests"] = json!("12");
+    assert!(result(&body).is_ok());
+    for bad in [
+        json!("1e2"),
+        json!(" 5"),
+        json!("5."),
+        json!(".5"),
+        json!(true),
+    ] {
+        body["budgets"][0]["limit_usd"] = bad.clone();
+        assert_parse_error(&body);
+    }
+    body["budgets"][0]["limit_usd"] = json!("100");
+    body["usage"]["requests"] = json!(12.5);
+    assert_parse_error(&body);
+}
+
+#[test]
+fn display_text_is_sanitized_and_bounded() {
+    let mut body = body();
+    body["key"]["name"] = json!(format!("bad\u{7}\nname{}", "x".repeat(300)));
+    let result = result(&body).unwrap();
+    let key = detail(&result, "key").value();
+    assert!(!key.chars().any(char::is_control));
+    assert_eq!(key.chars().count(), 120);
+}
+
+#[test]
+fn usage_url_supports_every_documented_base_form() {
+    for (base, expected) in [
+        (
+            "https://api.aixy-gateway.com",
+            "https://api.aixy-gateway.com/v1/usage",
+        ),
+        (
+            "https://api.aixy-gateway.com/",
+            "https://api.aixy-gateway.com/v1/usage",
+        ),
+        (
+            "https://api.aixy-gateway.com/v1",
+            "https://api.aixy-gateway.com/v1/usage",
+        ),
+        (
+            "https://aixy.example.com/prefix/v1/",
+            "https://aixy.example.com/prefix/v1/usage",
+        ),
+        ("aixy.example.com", "https://aixy.example.com/v1/usage"),
+        ("http://localhost:8080", "http://localhost:8080/v1/usage"),
+        ("http://10.1.2.3:8080/v1", "http://10.1.2.3:8080/v1/usage"),
+        (
+            "http://gateway.local/team",
+            "http://gateway.local/team/v1/usage",
+        ),
+    ] {
+        assert_eq!(usage_url(base).unwrap().as_str(), expected, "{base}");
+    }
+}
+
+#[test]
+fn usage_url_rejects_unsafe_bases() {
+    for base in [
+        "",
+        "http://api.aixy-gateway.com",
+        "http://8.8.8.8",
+        "ftp://10.1.2.3",
+        "https://user:secret@aixy.example.com",
+        "https://aixy.example.com?x=1",
+        "https://aixy.example.com/prefix#frag",
+    ] {
+        assert!(usage_url(base).is_err(), "{base}");
+    }
+    let message = usage_url("https://aixy.example.com?x=1")
+        .unwrap_err()
+        .to_string();
+    assert!(message.contains("must not contain a query or fragment"));
+    assert!(
+        validate_gateway_url("").is_ok(),
+        "empty selects the hosted gateway"
+    );
+    assert!(validate_gateway_url("http://localhost:9").is_ok());
+    assert!(validate_gateway_url("http://public.example.com").is_err());
+}
+
+#[tokio::test]
+async fn rejects_public_http_before_resolving_any_credential() {
+    let provider = AixyProvider::new();
+    let ctx = FetchContext {
+        gateway_url: Some("http://public.example.com".into()),
+        ..FetchContext::default()
+    };
+    let error = provider.fetch_api(&ctx).await.unwrap_err();
+    assert!(error.to_string().contains("must use HTTPS"), "{error}");
+}
+
+#[tokio::test]
+async fn unsupported_source_modes_are_rejected() {
+    let provider = AixyProvider::new();
+    let ctx = FetchContext {
+        source_mode: SourceMode::Web,
+        ..context("https://aixy.example.com")
+    };
+    assert!(matches!(
+        provider.fetch_usage(&ctx).await,
+        Err(ProviderError::UnsupportedSource(SourceMode::Web))
+    ));
+    assert_eq!(
+        provider.available_sources(),
+        vec![SourceMode::Auto, SourceMode::OAuth]
+    );
+}
+
+#[tokio::test]
+async fn fetch_sends_only_a_bearer_key_to_the_usage_endpoint() {
+    for (prefix, path) in [("", "/v1/usage"), ("/prefix/v1/", "/prefix/v1/usage")] {
+        let mut server = mockito::Server::new_async().await;
+        let mock = server
+            .mock("GET", path)
+            .match_header("authorization", format!("Bearer {API_KEY}").as_str())
+            .match_header("cookie", Matcher::Missing)
+            .with_status(200)
+            .with_header("content-type", "application/json")
+            .with_body(FIXTURE)
+            .expect(1)
+            .create_async()
+            .await;
+
+        let provider = AixyProvider::new();
+        let base = format!("{}{prefix}", server.url());
+        let result = provider.fetch_usage(&context(&base)).await.unwrap();
+
+        mock.assert_async().await;
+        assert_eq!(result.usage.primary.used_percent, 30.0);
+    }
+}
+
+#[tokio::test]
+async fn statuses_are_classified_without_echoing_the_body() {
+    for (status, expected) in [
+        (401, "auth"),
+        (403, "denied access"),
+        (404, "does not provide the usage endpoint"),
+        (429, "429"),
+        (503, "unavailable"),
+        (418, "failed (HTTP 418"),
+    ] {
+        let mut server = mockito::Server::new_async().await;
+        let _mock = server
+            .mock("GET", "/v1/usage")
+            .with_status(status)
+            .with_body("private upstream body")
+            .create_async()
+            .await;
+
+        let provider = AixyProvider::new();
+        let error = provider
+            .fetch_usage(&context(&server.url()))
+            .await
+            .unwrap_err();
+        if status == 401 {
+            assert!(matches!(error, ProviderError::AuthRequired), "{expected}");
+        } else {
+            let message = error.to_string();
+            assert!(message.contains(expected), "{status}: {message}");
+        }
+        assert!(!error.to_string().contains("private upstream body"));
+    }
+}
+
+#[tokio::test]
+async fn malformed_bodies_fail_without_echoing_them() {
+    let mut server = mockito::Server::new_async().await;
+    let _mock = server
+        .mock("GET", "/v1/usage")
+        .with_status(200)
+        .with_body("private upstream body")
+        .create_async()
+        .await;
+    let error = AixyProvider::new()
+        .fetch_usage(&context(&server.url()))
+        .await
+        .unwrap_err();
+    assert!(matches!(error, ProviderError::Parse(_)));
+    assert!(!error.to_string().contains("private upstream body"));
+}
+
+#[tokio::test]
+async fn does_not_forward_the_key_through_gateway_redirects() {
+    let mut server = mockito::Server::new_async().await;
+    let redirect = server
+        .mock("GET", "/v1/usage")
+        .match_header("authorization", format!("Bearer {API_KEY}").as_str())
+        .with_status(302)
+        .with_header("location", &format!("{}/redirected", server.url()))
+        .expect(1)
+        .create_async()
+        .await;
+    let target = server
+        .mock("GET", "/redirected")
+        .with_status(200)
+        .with_body(FIXTURE)
+        .expect(0)
+        .create_async()
+        .await;
+
+    let error = AixyProvider::new()
+        .fetch_usage(&context(&server.url()))
+        .await
+        .unwrap_err();
+
+    redirect.assert_async().await;
+    target.assert_async().await;
+    assert!(error.to_string().contains("302"), "{error}");
+}
diff --git a/rust/src/providers/bifrost/mod.rs b/rust/src/providers/bifrost/mod.rs
index d872103c12..58f005b228 100644
--- a/rust/src/providers/bifrost/mod.rs
+++ b/rust/src/providers/bifrost/mod.rs
@@ -7,7 +7,7 @@ use async_trait::async_trait;
 use chrono::{DateTime, Utc};
 use reqwest::{Client, StatusCode, Url};
 use serde_json::Value;
-use std::{net::IpAddr, time::Duration};
+use std::time::Duration;
 
 use crate::core::{
     CostSnapshot, FetchContext, Provider, ProviderDisplayDetail, ProviderError,
@@ -227,19 +227,7 @@ pub fn validate_gateway_url(raw: &str) -> Result<(), ProviderError> {
 }
 
 fn is_private_http_host(host: &str) -> bool {
-    if host.eq_ignore_ascii_case("localhost") || host.ends_with(".localhost") {
-        return true;
-    }
-    let host = host.trim_start_matches('[').trim_end_matches(']');
-    let Ok(ip) = host.parse::<IpAddr>() else {
-        return false;
-    };
-    match ip {
-        IpAddr::V4(ip) => ip.is_private() || ip.is_loopback() || ip.is_link_local(),
-        IpAddr::V6(ip) => {
-            ip.is_loopback() || ip.is_unique_local() || (ip.segments()[0] & 0xffc0) == 0xfe80
-        }
-    }
+    crate::providers::is_private_network_host(host)
 }
 
 fn parse_usage(value: &Value, now: DateTime<Utc>) -> Result<ParsedUsage, ProviderError> {
diff --git a/rust/src/providers/mod.rs b/rust/src/providers/mod.rs
index d2f8ca4190..e76b6b7be1 100755
--- a/rust/src/providers/mod.rs
+++ b/rust/src/providers/mod.rs
@@ -9,6 +9,7 @@ use futures::{Stream, StreamExt};
 
 pub mod abacus;
 pub mod aiand;
+pub mod aixy;
 pub mod alibaba;
 pub mod alibabatokenplan;
 pub mod amp;
@@ -95,6 +96,7 @@ pub mod zoommate;
 // Re-export provider implementations
 pub use abacus::AbacusProvider;
 pub use aiand::AiAndProvider;
+pub use aixy::AixyProvider;
 pub use alibaba::{AlibabaProvider, AlibabaRegion};
 pub use alibabatokenplan::{AlibabaTokenPlanProvider, AlibabaTokenPlanRegion};
 pub use amp::AmpProvider;
@@ -176,6 +178,26 @@ pub use zed::ZedProvider;
 pub use zenmux::ZenMuxProvider;
 pub use zoommate::ZoomMateProvider;
 
+/// True for hosts where plain HTTP is acceptable for a self-hosted gateway:
+/// `localhost`, `*.localhost`, and loopback, private or link-local IP literals.
+pub(crate) fn is_private_network_host(host: &str) -> bool {
+    use std::net::IpAddr;
+
+    if host.eq_ignore_ascii_case("localhost") || host.ends_with(".localhost") {
+        return true;
+    }
+    let host = host.trim_start_matches('[').trim_end_matches(']');
+    let Ok(ip) = host.parse::<IpAddr>() else {
+        return false;
+    };
+    match ip {
+        IpAddr::V4(ip) => ip.is_private() || ip.is_loopback() || ip.is_link_local(),
+        IpAddr::V6(ip) => {
+            ip.is_loopback() || ip.is_unique_local() || (ip.segments()[0] & 0xffc0) == 0xfe80
+        }
+    }
+}
+
 #[derive(Debug, PartialEq)]
 pub(crate) enum BoundedBodyError<E> {
     TooLarge,
diff --git a/rust/src/settings/api_keys.rs b/rust/src/settings/api_keys.rs
index 93ddb57226..8ef51ff37d 100644
--- a/rust/src/settings/api_keys.rs
+++ b/rust/src/settings/api_keys.rs
@@ -652,6 +652,17 @@ pub fn get_api_key_providers() -> Vec<ProviderConfigInfo> {
             config_file_path: None,
             dashboard_url: None,
         },
+        ProviderConfigInfo {
+            id: ProviderId::Aixy,
+            name: "Aixy",
+            requires_api_key: true,
+            api_key_env_var: Some("AIXY_API_KEY"),
+            api_key_help: Some(
+                "Save an Aixy API key. Leave the Base URL empty for the hosted gateway, or set it for a self-hosted one. Or set AIXY_API_KEY and AIXY_BASE_URL.",
+            ),
+            config_file_path: None,
+            dashboard_url: Some("https://dash.aixy-gateway.com"),
+        },
     ]
 }
 

From d472fc3fa1c1dd3a013fdc2d5c9440e332a8a4e6 Mon Sep 17 00:00:00 2001
From: RCD <90105158+Finesssee@users.noreply.github.com>
Date: Wed, 30 Sep 2026 20:46:42 +0700
Subject: [PATCH 2/2] Address thermo review

---
 .../src-tauri/src/commands/bridge.rs          |  3 +
 .../src-tauri/src/commands/tests.rs           | 10 +++
 .../src/components/MenuCard.test.tsx          | 74 +++++++++++++++++++
 .../src/components/MenuCardDetails.tsx        | 66 ++++++++---------
 .../src/components/ProviderDisplayRow.tsx     | 43 ++++++++++-
 .../sections/MenuBarMetricSection.test.tsx    |  3 +-
 .../sections/MenuBarMetricSection.tsx         |  6 +-
 .../providers/sections/UsageSection.tsx       | 38 +++++++---
 apps/desktop-tauri/src/types/bridge.ts        |  1 +
 rust/src/core/display_detail.rs               | 16 ++++
 rust/src/core/usage_snapshot.rs               | 18 +++++
 rust/src/locale/es-MX.ftl                     |  3 +
 rust/src/locale/ja-JP.ftl                     |  3 +
 rust/src/locale/ko-KR.ftl                     |  3 +
 rust/src/locale/ru-RU.ftl                     |  3 +
 rust/src/locale/tests.rs                      |  7 ++
 rust/src/locale/tr-TR.ftl                     |  3 +
 rust/src/locale/zh-CN.ftl                     |  3 +
 rust/src/locale/zh-TW.ftl                     |  3 +
 rust/src/providers/aixy/present.rs            | 34 +++++----
 rust/src/providers/aixy/tests.rs              |  5 +-
 21 files changed, 279 insertions(+), 66 deletions(-)

diff --git a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
index a69be60f1c..4f3af6a351 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/bridge.rs
@@ -206,6 +206,8 @@ pub struct ProviderDisplayProgressSnapshot {
 #[serde(rename_all = "camelCase")]
 pub struct ProviderDisplayDetailSnapshot {
     pub id: String,
+    #[serde(default)]
+    pub section_title: Option<String>,
     pub title: String,
     pub value: String,
     pub secondary_value: Option<String>,
@@ -438,6 +440,7 @@ impl ProviderUsageSnapshot {
                 .iter()
                 .map(|detail| ProviderDisplayDetailSnapshot {
                     id: detail.id().to_string(),
+                    section_title: detail.section_title().map(ToOwned::to_owned),
                     title: detail.title().to_string(),
                     value: detail.value().to_string(),
                     secondary_value: detail.secondary_value().map(ToOwned::to_owned),
diff --git a/apps/desktop-tauri/src-tauri/src/commands/tests.rs b/apps/desktop-tauri/src-tauri/src/commands/tests.rs
index 94ac348f11..7383eb2503 100644
--- a/apps/desktop-tauri/src-tauri/src/commands/tests.rs
+++ b/apps/desktop-tauri/src-tauri/src/commands/tests.rs
@@ -1115,6 +1115,7 @@ fn provider_inventory_maps_to_the_bridge_without_token_ids() {
     .with_display_detail(
         ProviderDisplayDetail::new("credits", "Used this cycle", "12")
             .and_then(|row| row.with_secondary_value("Monthly refill: 100"))
+            .and_then(|row| row.with_section_title("Credit usage"))
             .and_then(|row| row.with_progress(12.0, 100.0)),
     );
     let metadata = instantiate_provider(ProviderId::Grok).metadata().clone();
@@ -1129,6 +1130,15 @@ fn provider_inventory_maps_to_the_bridge_without_token_ids() {
     );
     assert_eq!(snapshot.display_details.len(), 1);
     assert_eq!(snapshot.display_details[0].value, "12");
+    assert_eq!(
+        snapshot.display_details[0].section_title.as_deref(),
+        Some("Credit usage")
+    );
+    let snapshot_json = serde_json::to_value(&snapshot).unwrap();
+    assert_eq!(
+        snapshot_json["displayDetails"][0]["sectionTitle"],
+        "Credit usage"
+    );
     assert_eq!(
         snapshot.display_details[0].secondary_value.as_deref(),
         Some("Monthly refill: 100")
diff --git a/apps/desktop-tauri/src/components/MenuCard.test.tsx b/apps/desktop-tauri/src/components/MenuCard.test.tsx
index c8ec795546..02e9b99cad 100644
--- a/apps/desktop-tauri/src/components/MenuCard.test.tsx
+++ b/apps/desktop-tauri/src/components/MenuCard.test.tsx
@@ -601,6 +601,80 @@ describe("MenuCard", () => {
     expect(details.open).toBe(true);
   });
 
+  it("renders provider detail rows once with separated secondary values and accessible progress", async () => {
+    const snapshot = provider(null);
+    snapshot.providerId = "aixy";
+    snapshot.displayName = "Aixy";
+    snapshot.displayDetails = [
+      {
+        id: "budget-0",
+        sectionTitle: "Applicable budgets",
+        title: "Project · Monthly · Shared · Hard",
+        value: "$70.00 / $100.00 remaining",
+        secondaryValue: "$20.00 spent · $10.00 reserved",
+        progress: { used: 30, total: 100 },
+      },
+    ];
+
+    const { container } = renderCard(snapshot);
+
+    await screen.findByRole("progressbar", {
+      name: "Project · Monthly · Shared · Hard progress",
+    });
+    expect(container.querySelectorAll(".menu-card__provider-details")).toHaveLength(1);
+    expect(container.textContent).toContain(
+      "$70.00 / $100.00 remaining $20.00 spent · $10.00 reserved",
+    );
+    expect(
+      screen.getByRole("progressbar", {
+        name: "Project · Monthly · Shared · Hard progress",
+      }),
+    ).toHaveAttribute("aria-valuenow", "30");
+  });
+
+  it("hides provider display details in compact overview cards", () => {
+    const snapshot = provider(null);
+    snapshot.providerId = "aixy";
+    snapshot.displayDetails = [
+      {
+        id: "budget-0",
+        sectionTitle: "Applicable budgets",
+        title: "Project · Monthly · Shared · Hard",
+        value: "$70.00 / $100.00 remaining",
+        secondaryValue: "$20.00 spent · $10.00 reserved",
+        progress: { used: 30, total: 100 },
+      },
+    ];
+
+    const { container } = renderCard(snapshot, { compactOverview: true });
+
+    expect(container.querySelector(".menu-card__provider-details")).not.toBeInTheDocument();
+  });
+
+  it("splits provider detail sections after 24 rows", async () => {
+    const snapshot = provider(null);
+    snapshot.providerId = "aixy";
+    snapshot.displayDetails = Array.from({ length: 25 }, (_, index) => ({
+      id: `budget-${index}`,
+      sectionTitle: "Applicable budgets",
+      title: `Budget ${index}`,
+      value: "$0.00 remaining",
+      secondaryValue: null,
+      progress: null,
+    }));
+
+    const { container } = renderCard(snapshot);
+
+    await screen.findAllByRole("heading", { name: "Applicable budgets" });
+    const sections = container.querySelectorAll(".menu-card__provider-details");
+    expect(sections).toHaveLength(2);
+    expect(
+      screen.getAllByRole("heading", { name: "Applicable budgets" }),
+    ).toHaveLength(2);
+    expect(sections[0].querySelectorAll(".menu-card__cost-line")).toHaveLength(24);
+    expect(sections[1].querySelectorAll(".menu-card__cost-line")).toHaveLength(1);
+  });
+
   it("places Claude accounts above metrics and the collapsed usage details", async () => {
     tauriMocks.claudeAccountsList.mockResolvedValue([
       { id: "a", email: "a@example.com", organization: "Personal", isActive: true, isSaved: true },
diff --git a/apps/desktop-tauri/src/components/MenuCardDetails.tsx b/apps/desktop-tauri/src/components/MenuCardDetails.tsx
index 31634bd910..d446fa74c5 100644
--- a/apps/desktop-tauri/src/components/MenuCardDetails.tsx
+++ b/apps/desktop-tauri/src/components/MenuCardDetails.tsx
@@ -2,7 +2,6 @@ import { useState } from "react";
 import type {
   CostSummaryDisplayStyle,
   DailyCostPoint,
-  ProviderDisplayDetail,
   PaceSnapshot,
   ProviderInventoryItem,
   ProviderChartData,
@@ -22,6 +21,10 @@ import type { LocaleKey } from "../i18n/keys";
 import { paceCategory } from "../surfaces/tray/paceCategory";
 import { SimpleBarChart, StackedBarChart } from "./MiniBarChart";
 import { InventoryItemRow } from "./InventoryRows";
+import {
+  groupProviderDisplayDetails,
+  ProviderDisplayRow,
+} from "./ProviderDisplayRow";
 import { QuotaWindowHistory } from "./QuotaWindowHistory";
 import { getPaceBudget, type PaceBudget } from "../lib/paceBudget";
 import PaceDetailsChart from "./PaceDetailsChart";
@@ -541,6 +544,9 @@ export default function MenuCardDetails({
   );
   const localCostHistory = chartData?.costHistory ?? [];
   const costStyle = display.costSummaryDisplayStyle ?? "detailed";
+  const displayDetailGroups = groupProviderDisplayDetails(
+    provider.displayDetails ?? [],
+  );
 
   const {
     hasMetrics,
@@ -596,19 +602,28 @@ export default function MenuCardDetails({
         </section>
       )}
       {!provider.error && hasDisplayDetails && !compactOverview && (
-        <section className="menu-card__group menu-card__provider-details">
-          {provider.displayDetails?.map((detail, index) => (
-            <DisplayDetailRow key={`${detail.id}-${index}`} detail={detail} />
-          ))}
-        </section>
-      )}
-
-      {!provider.error && hasDisplayDetails && (
-        <section className="menu-card__group menu-card__provider-details">
-          {provider.displayDetails?.map((detail, index) => (
-            <DisplayDetailRow key={`${detail.id}-${index}`} detail={detail} />
-          ))}
-        </section>
+        displayDetailGroups.map((group) => (
+          <section
+            className="menu-card__group menu-card__provider-details"
+            key={group.id}
+          >
+            {group.title && (
+              <div className="menu-card__group-title" role="heading" aria-level={4}>
+                {group.title}
+              </div>
+            )}
+            {group.rows.map((detail, index) => (
+              <ProviderDisplayRow
+                key={`${detail.id}-${index}`}
+                detail={detail}
+                lineClassName="menu-card__cost-line"
+                secondaryClassName="menu-card__cost-line--muted"
+                trackClassName="menu-metric__bar"
+                fillClassName="menu-metric__bar-fill"
+              />
+            ))}
+          </section>
+        ))
       )}
 
       {wayfinderUsage && !compactOverview && <WayfinderUsageBlock usage={wayfinderUsage} />}
@@ -786,26 +801,3 @@ export default function MenuCardDetails({
     </div>
   );
 }
-
-function DisplayDetailRow({ detail }: { detail: ProviderDisplayDetail }) {
-  const progress = detail.progress;
-  const progressPercent = progress && Number.isFinite(progress.used) && Number.isFinite(progress.total) && progress.total > 0
-    ? Math.max(0, Math.min(100, (progress.used / progress.total) * 100))
-    : null;
-
-  return (
-    <div className="menu-card__provider-detail">
-      <div className="menu-card__cost-line">
-        <span>{detail.title}: {detail.value}</span>
-        {detail.secondaryValue && (
-          <span className="menu-card__cost-line--muted">{detail.secondaryValue}</span>
-        )}
-      </div>
-      {progressPercent != null && (
-        <div className="menu-metric__bar" aria-label={`${detail.title} progress`}>
-          <div className="menu-metric__bar-fill" style={{ width: `${progressPercent}%` }} />
-        </div>
-      )}
-    </div>
-  );
-}
diff --git a/apps/desktop-tauri/src/components/ProviderDisplayRow.tsx b/apps/desktop-tauri/src/components/ProviderDisplayRow.tsx
index 86982b66e4..b39fbe3ef3 100644
--- a/apps/desktop-tauri/src/components/ProviderDisplayRow.tsx
+++ b/apps/desktop-tauri/src/components/ProviderDisplayRow.tsx
@@ -1,5 +1,34 @@
 import type { ProviderDisplayDetail } from "../types/bridge";
 
+const MAX_ROWS_PER_SECTION = 24;
+
+export interface ProviderDisplayDetailGroup {
+  id: number;
+  title: string | null;
+  rows: ProviderDisplayDetail[];
+}
+
+/** Group consecutive provider details and cap each rendered section. */
+export function groupProviderDisplayDetails(
+  details: ProviderDisplayDetail[],
+): ProviderDisplayDetailGroup[] {
+  const groups: ProviderDisplayDetailGroup[] = [];
+  for (const detail of details) {
+    const title = detail.sectionTitle ?? null;
+    const current = groups[groups.length - 1];
+    if (
+      current &&
+      current.title === title &&
+      current.rows.length < MAX_ROWS_PER_SECTION
+    ) {
+      current.rows.push(detail);
+    } else {
+      groups.push({ id: groups.length, title, rows: [detail] });
+    }
+  }
+  return groups;
+}
+
 /**
  * One transient provider detail line: "{title}: {value} [secondary]"
  * plus an optional clamped progress bar.
@@ -34,11 +63,21 @@ export function ProviderDisplayRow({
       <div className={lineClassName}>
         <span>{detail.title}: {detail.value}</span>
         {detail.secondaryValue && secondaryClassName && (
-          <span className={secondaryClassName}>{detail.secondaryValue}</span>
+          <>
+            {" "}
+            <span className={secondaryClassName}>{detail.secondaryValue}</span>
+          </>
         )}
       </div>
       {progressPercent != null && (
-        <div className={trackClassName} aria-label={`${detail.title} progress`}>
+        <div
+          className={trackClassName}
+          role="progressbar"
+          aria-label={`${detail.title} progress`}
+          aria-valuemin={0}
+          aria-valuemax={100}
+          aria-valuenow={progressPercent}
+        >
           <div className={fillClassName} style={{ width: `${progressPercent}%` }} />
         </div>
       )}
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
index 1c1315b9da..78494f71ec 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.test.tsx
@@ -132,7 +132,7 @@ describe("MenuBarMetricSection", () => {
     render(
       <MenuBarMetricSection
         provider={aixy}
-        providerMetrics={{}}
+        providerMetrics={{ aixy: "weekly" }}
         disabled={false}
         t={(key) => key}
         onChange={vi.fn()}
@@ -141,5 +141,6 @@ describe("MenuBarMetricSection", () => {
 
     const options = screen.getAllByRole("option").map((option) => option.textContent);
     expect(options).toEqual(["Automatic"]);
+    expect(screen.getByRole("combobox")).toHaveValue("automatic");
   });
 });
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
index f8ff1eb89f..f0716229ce 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/MenuBarMetricSection.tsx
@@ -30,7 +30,9 @@ export function MenuBarMetricSection({
   onChange,
 }: Props) {
   const [error, setError] = useState<string | null>(null);
-  const selected = providerMetrics[provider.id] ?? "automatic";
+  const selected = AUTOMATIC_ONLY_PROVIDERS.has(provider.id)
+    ? "automatic"
+    : providerMetrics[provider.id] ?? "automatic";
   const options = metricOptions(provider, selected, t);
 
   const handleChange = (value: MetricPreference) => {
@@ -83,7 +85,7 @@ function metricOptions(
   // Aixy's primary budget depends on which limits currently apply to the key,
   // so a fixed session/weekly lane would be misleading. Offer Automatic only.
   if (AUTOMATIC_ONLY_PROVIDERS.has(provider.id)) {
-    return withSelected(options, selected, t);
+    return options;
   }
 
   options.push({ value: "session", label: t("ProviderSessionLabel") });
diff --git a/apps/desktop-tauri/src/surfaces/settings/providers/sections/UsageSection.tsx b/apps/desktop-tauri/src/surfaces/settings/providers/sections/UsageSection.tsx
index b2d24dbdfc..e46e867a87 100644
--- a/apps/desktop-tauri/src/surfaces/settings/providers/sections/UsageSection.tsx
+++ b/apps/desktop-tauri/src/surfaces/settings/providers/sections/UsageSection.tsx
@@ -5,7 +5,10 @@ import type {
   RateWindowSnapshot,
 } from "../../../../types/bridge";
 import { InventoryItemRow } from "../../../../components/InventoryRows";
-import { ProviderDisplayRow } from "../../../../components/ProviderDisplayRow";
+import {
+  groupProviderDisplayDetails,
+  ProviderDisplayRow,
+} from "../../../../components/ProviderDisplayRow";
 import type { LocaleKey } from "../../../../i18n/keys";
 import { useFormattedResetTime } from "../../../../hooks/useFormattedResetTime";
 import { isUsageItemVisible } from "../../../../lib/usageItemVisibility";
@@ -70,6 +73,7 @@ export function UsageSection({ provider, resetTimeRelative, t }: Props) {
 
   const inventory = provider.inventory ?? [];
   const displayDetails = provider.displayDetails ?? [];
+  const displayDetailGroups = groupProviderDisplayDetails(displayDetails);
   if (bars.length === 0 && inventory.length === 0 && displayDetails.length === 0) {
     return null;
   }
@@ -94,14 +98,28 @@ export function UsageSection({ provider, resetTimeRelative, t }: Props) {
           lineClassName="provider-usage-inventory"
         />
       ))}
-      {displayDetails.map((detail) => (
-        <ProviderDisplayRow
-          key={detail.id}
-          detail={detail}
-          lineClassName="provider-usage-inventory"
-          trackClassName="provider-usage-bar__track"
-          fillClassName="provider-usage-bar__fill"
-        />
+      {displayDetailGroups.map((group) => (
+        <div key={group.id}>
+          {group.title && (
+            <div
+              className="provider-detail-field__label"
+              role="heading"
+              aria-level={5}
+            >
+              {group.title}
+            </div>
+          )}
+          {group.rows.map((detail) => (
+            <ProviderDisplayRow
+              key={detail.id}
+              detail={detail}
+              lineClassName="provider-usage-inventory"
+              secondaryClassName="provider-detail-field__label"
+              trackClassName="provider-usage-bar__track"
+              fillClassName="provider-usage-bar__fill"
+            />
+          ))}
+        </div>
       ))}
     </section>
   );
@@ -163,4 +181,4 @@ function UsageBar({
       )}
     </div>
   );
-}
\ No newline at end of file
+}
diff --git a/apps/desktop-tauri/src/types/bridge.ts b/apps/desktop-tauri/src/types/bridge.ts
index fd8dd55109..233f7c0688 100644
--- a/apps/desktop-tauri/src/types/bridge.ts
+++ b/apps/desktop-tauri/src/types/bridge.ts
@@ -635,6 +635,7 @@ export interface ProviderDisplayProgress {
 /** Transient provider detail row; it is display-only and never quota math. */
 export interface ProviderDisplayDetail {
   id: string;
+  sectionTitle: string | null;
   title: string;
   value: string;
   secondaryValue: string | null;
diff --git a/rust/src/core/display_detail.rs b/rust/src/core/display_detail.rs
index 1c80831aa3..cd5720d860 100644
--- a/rust/src/core/display_detail.rs
+++ b/rust/src/core/display_detail.rs
@@ -18,6 +18,7 @@ use crate::core::ProviderFetchResult;
 #[derive(Debug, Clone, PartialEq)]
 pub struct ProviderDisplayDetail {
     id: String,
+    section_title: Option<String>,
     title: String,
     value: String,
     secondary_value: Option<String>,
@@ -40,6 +41,7 @@ impl ProviderDisplayDetail {
     ) -> Option<Self> {
         let row = Self {
             id: id.into(),
+            section_title: None,
             title: title.into(),
             value: value.into(),
             secondary_value: None,
@@ -51,6 +53,16 @@ impl ProviderDisplayDetail {
         valid.then_some(row)
     }
 
+    /// Attach an optional display section title; rejects invalid text.
+    pub fn with_section_title(mut self, title: impl Into<String>) -> Option<Self> {
+        let title = title.into();
+        if !is_display_shape(&title, 128) {
+            return None;
+        }
+        self.section_title = Some(title);
+        Some(self)
+    }
+
     /// Attach a validated secondary value; rejects invalid text.
     pub fn with_secondary_value(mut self, value: impl Into<String>) -> Option<Self> {
         let value = value.into();
@@ -74,6 +86,10 @@ impl ProviderDisplayDetail {
         &self.id
     }
 
+    pub fn section_title(&self) -> Option<&str> {
+        self.section_title.as_deref()
+    }
+
     pub fn title(&self) -> &str {
         &self.title
     }
diff --git a/rust/src/core/usage_snapshot.rs b/rust/src/core/usage_snapshot.rs
index ebbdcb8c20..3014476745 100755
--- a/rust/src/core/usage_snapshot.rs
+++ b/rust/src/core/usage_snapshot.rs
@@ -758,6 +758,24 @@ mod tests {
         assert_eq!(details[0].value(), "12");
     }
 
+    #[test]
+    fn display_details_validate_optional_section_titles() {
+        let usage = UsageSnapshot::new(RateWindow::new(25.0));
+        let row = ProviderDisplayDetail::new("budget", "Project", "$10 remaining")
+            .and_then(|row| row.with_section_title("Applicable budgets"));
+        let result = ProviderFetchResult::new(usage, "api").with_display_detail(row);
+
+        assert_eq!(
+            result.display_details()[0].section_title(),
+            Some("Applicable budgets")
+        );
+        assert!(
+            ProviderDisplayDetail::new("budget", "Project", "$10")
+                .and_then(|row| row.with_section_title("\n"))
+                .is_none()
+        );
+    }
+
     #[test]
     fn cost_snapshot_ignores_non_finite_values() {
         let cost = CostSnapshot::new(f64::NAN, "USD", "Monthly").with_limit(f64::INFINITY);
diff --git a/rust/src/locale/es-MX.ftl b/rust/src/locale/es-MX.ftl
index bae2c814c3..9d51ff351a 100644
--- a/rust/src/locale/es-MX.ftl
+++ b/rust/src/locale/es-MX.ftl
@@ -80,6 +80,9 @@ WayfinderGatewayTitle = Gateway de Wayfinder
 WayfinderGatewayLabel = URL del gateway
 WayfinderGatewayHelp = Usa HTTP solo para localhost o direcciones de loopback. HTTPS permite hosts remotos.
 WayfinderGatewayStatus = Gateway
+AixyGatewayTitle = Gateway de Aixy
+AixyGatewayLabel = URL base
+AixyGatewayHelp = Déjalo vacío para usar el gateway alojado de Aixy o introduce la URL base de uno propio. HTTP solo se permite para localhost, redes privadas y hosts .local.
 WayfinderModels = Modelos
 WayfinderRequests = Solicitudes
 WayfinderTokens = Tokens
diff --git a/rust/src/locale/ja-JP.ftl b/rust/src/locale/ja-JP.ftl
index 92618f72f7..2b1651507d 100644
--- a/rust/src/locale/ja-JP.ftl
+++ b/rust/src/locale/ja-JP.ftl
@@ -80,6 +80,9 @@ WayfinderGatewayTitle = Wayfinder ゲートウェイ
 WayfinderGatewayLabel = ゲートウェイ URL
 WayfinderGatewayHelp = HTTP は localhost またはループバックアドレスでのみ使用できます。リモートホストには HTTPS を使用します。
 WayfinderGatewayStatus = ゲートウェイ
+AixyGatewayTitle = Aixy ゲートウェイ
+AixyGatewayLabel = ベース URL
+AixyGatewayHelp = ホスト型 Aixy ゲートウェイを使う場合は空欄にするか、自分でホストするゲートウェイのベース URL を入力してください。HTTP は localhost、プライベートネットワーク、.local ホストでのみ使用できます。
 WayfinderModels = モデル
 WayfinderRequests = リクエスト
 WayfinderTokens = トークン
diff --git a/rust/src/locale/ko-KR.ftl b/rust/src/locale/ko-KR.ftl
index 7f59c6fc29..6988fded06 100644
--- a/rust/src/locale/ko-KR.ftl
+++ b/rust/src/locale/ko-KR.ftl
@@ -80,6 +80,9 @@ WayfinderGatewayTitle = Wayfinder 게이트웨이
 WayfinderGatewayLabel = 게이트웨이 URL
 WayfinderGatewayHelp = HTTP는 localhost 또는 루프백 주소에서만 사용하세요. 원격 호스트에는 HTTPS를 사용합니다.
 WayfinderGatewayStatus = 게이트웨이
+AixyGatewayTitle = Aixy 게이트웨이
+AixyGatewayLabel = 기본 URL
+AixyGatewayHelp = 호스팅된 Aixy 게이트웨이를 사용하려면 비워 두거나 자체 호스팅 게이트웨이의 기본 URL을 입력하세요. HTTP는 localhost, 사설 네트워크 및 .local 호스트에서만 허용됩니다.
 WayfinderModels = 모델
 WayfinderRequests = 요청
 WayfinderTokens = 토큰
diff --git a/rust/src/locale/ru-RU.ftl b/rust/src/locale/ru-RU.ftl
index 855f7a9eb6..afc216937e 100644
--- a/rust/src/locale/ru-RU.ftl
+++ b/rust/src/locale/ru-RU.ftl
@@ -64,6 +64,9 @@ WayfinderGatewayTitle = Шлюз Wayfinder
 WayfinderGatewayLabel = URL-адрес шлюза
 WayfinderGatewayHelp = Используйте HTTP только для локальных адресов или адресов обратной связи. HTTPS разрешен для удаленных хостов.
 WayfinderGatewayStatus = шлюз
+AixyGatewayTitle = Шлюз Aixy
+AixyGatewayLabel = Базовый URL
+AixyGatewayHelp = Оставьте пустым для размещенного шлюза Aixy или укажите базовый URL собственного шлюза. HTTP разрешен только для localhost, частных сетей и хостов .local.
 WayfinderModels = Модели
 WayfinderRequests = Запросы
 WayfinderTokens = Токены
diff --git a/rust/src/locale/tests.rs b/rust/src/locale/tests.rs
index 9daf93d809..d11c4241ae 100644
--- a/rust/src/locale/tests.rs
+++ b/rust/src/locale/tests.rs
@@ -397,8 +397,15 @@ fn test_english_is_complete_and_other_languages_can_fallback() {
         .map(|(locale, resource)| (locale, resource_key_names(resource)))
         .collect();
     let locale_key_names: HashSet<&str> = LocaleKey::ALL.iter().map(|(_, name)| *name).collect();
+    let aixy_gateway_keys = ["AixyGatewayTitle", "AixyGatewayLabel", "AixyGatewayHelp"];
 
     for (locale, keys) in &resource_keys {
+        for name in aixy_gateway_keys {
+            assert!(
+                keys.contains(name),
+                "missing Aixy gateway Fluent key {name} in {locale}"
+            );
+        }
         for name in keys {
             assert!(
                 locale_key_names.contains(name),
diff --git a/rust/src/locale/tr-TR.ftl b/rust/src/locale/tr-TR.ftl
index ca4fabe791..fa2f864995 100644
--- a/rust/src/locale/tr-TR.ftl
+++ b/rust/src/locale/tr-TR.ftl
@@ -86,6 +86,9 @@ WayfinderGatewayTitle = Wayfinder Ağ Geçidi
 WayfinderGatewayLabel = Ağ Geçidi URL'si
 WayfinderGatewayHelp = HTTP'yi yalnızca localhost veya geri döngü adresleri için kullanın. Uzak sunucular için HTTPS kullanılabilir.
 WayfinderGatewayStatus = Ağ Geçidi
+AixyGatewayTitle = Aixy Ağ Geçidi
+AixyGatewayLabel = Temel URL
+AixyGatewayHelp = Barındırılan Aixy ağ geçidini kullanmak için boş bırakın veya kendi ağ geçidinizin temel URL'sini girin. HTTP yalnızca localhost, özel ağlar ve .local ana bilgisayarları için kullanılabilir.
 WayfinderModels = Modeller
 WayfinderRequests = İstekler
 WayfinderTokens = Tokenlar
diff --git a/rust/src/locale/zh-CN.ftl b/rust/src/locale/zh-CN.ftl
index 98dd870db8..f8441f203d 100644
--- a/rust/src/locale/zh-CN.ftl
+++ b/rust/src/locale/zh-CN.ftl
@@ -80,6 +80,9 @@ WayfinderGatewayTitle = Wayfinder 网关
 WayfinderGatewayLabel = 网关 URL
 WayfinderGatewayHelp = HTTP 仅可用于 localhost 或回环地址。远程主机请使用 HTTPS。
 WayfinderGatewayStatus = 网关
+AixyGatewayTitle = Aixy 网关
+AixyGatewayLabel = 基础 URL
+AixyGatewayHelp = 留空以使用托管的 Aixy 网关，或输入自托管网关的基础 URL。HTTP 仅允许用于 localhost、专用网络和 .local 主机。
 WayfinderModels = 模型
 WayfinderRequests = 请求
 WayfinderTokens = 令牌
diff --git a/rust/src/locale/zh-TW.ftl b/rust/src/locale/zh-TW.ftl
index f893d5b423..e7af97178b 100644
--- a/rust/src/locale/zh-TW.ftl
+++ b/rust/src/locale/zh-TW.ftl
@@ -80,6 +80,9 @@ WayfinderGatewayTitle = Wayfinder 閘道
 WayfinderGatewayLabel = 閘道 URL
 WayfinderGatewayHelp = HTTP 僅可用於 localhost 或迴路位址。遠端主機請使用 HTTPS。
 WayfinderGatewayStatus = 閘道
+AixyGatewayTitle = Aixy 閘道
+AixyGatewayLabel = 基礎 URL
+AixyGatewayHelp = 留空以使用託管的 Aixy 閘道，或輸入自架閘道的基礎 URL。HTTP 僅允許用於 localhost、私人網路和 .local 主機。
 WayfinderModels = 模型
 WayfinderRequests = 請求
 WayfinderTokens = 權杖
diff --git a/rust/src/providers/aixy/present.rs b/rust/src/providers/aixy/present.rs
index be49923ef9..87f5669478 100644
--- a/rust/src/providers/aixy/present.rs
+++ b/rust/src/providers/aixy/present.rs
@@ -81,22 +81,24 @@ fn rate_window(budget: &Budget) -> RateWindow {
 
 fn details(usage: &KeyUsage) -> Vec<Option<ProviderDisplayDetail>> {
     let mut rows = vec![
-        ProviderDisplayDetail::new("key", "Key", &usage.key_label),
-        ProviderDisplayDetail::new("project", "Project", &usage.project_label),
+        ProviderDisplayDetail::new("key", "Key", &usage.key_label)
+            .and_then(|row| row.with_section_title("Aixy key")),
+        ProviderDisplayDetail::new("project", "Project", &usage.project_label)
+            .and_then(|row| row.with_section_title("Aixy key")),
         ProviderDisplayDetail::new(
             "observed",
             "Observed",
             usage.as_of.to_rfc3339_opts(SecondsFormat::Millis, true),
-        ),
+        )
+        .and_then(|row| row.with_section_title("Aixy key")),
     ];
     rows.extend(usage.budgets.iter().enumerate().map(budget_row));
     match &usage.totals {
         Some(totals) => rows.extend(totals_rows(totals)),
-        None => rows.push(ProviderDisplayDetail::new(
-            "usage-7d",
-            "Usage (last 7 days)",
-            "Unavailable",
-        )),
+        None => rows.push(
+            ProviderDisplayDetail::new("usage-7d", "Usage (last 7 days)", "Unavailable")
+                .and_then(|row| row.with_section_title("Last 7 days · this key")),
+        ),
     }
     rows
 }
@@ -105,7 +107,8 @@ fn budget_row((index, budget): (usize, &Budget)) -> Option<ProviderDisplayDetail
     let id = format!("budget-{index}");
     let (Some(remaining), Some(spent), true) = (budget.remaining, budget.spent, budget.known)
     else {
-        return ProviderDisplayDetail::new(id, &budget.title, "Unavailable");
+        return ProviderDisplayDetail::new(id, &budget.title, "Unavailable")
+            .and_then(|row| row.with_section_title("Applicable budgets"));
     };
     let spent = if budget.hard {
         format!("{} spent · {} reserved", usd(spent), usd(budget.reserved))
@@ -119,6 +122,7 @@ fn budget_row((index, budget): (usize, &Budget)) -> Option<ProviderDisplayDetail
     )
     .and_then(|row| row.with_secondary_value(spent))
     .and_then(|row| row.with_progress(budget.used_percent, 100.0))
+    .and_then(|row| row.with_section_title("Applicable budgets"))
 }
 
 fn totals_rows(totals: &Totals) -> Vec<Option<ProviderDisplayDetail>> {
@@ -127,19 +131,22 @@ fn totals_rows(totals: &Totals) -> Vec<Option<ProviderDisplayDetail>> {
             "requests-7d",
             "Requests (last 7 days)",
             count(totals.requests),
-        ),
+        )
+        .and_then(|row| row.with_section_title("Last 7 days · this key")),
         ProviderDisplayDetail::new(
             "tokens-7d",
             "Tokens (last 7 days)",
             count(totals.total_tokens),
-        ),
+        )
+        .and_then(|row| row.with_section_title("Last 7 days · this key")),
         ProviderDisplayDetail::new(
             "spend-7d",
             "Attributed spend (last 7 days)",
             totals
                 .spend_usd
                 .map_or_else(|| "Unavailable".to_owned(), usd),
-        ),
+        )
+        .and_then(|row| row.with_section_title("Last 7 days · this key")),
         ProviderDisplayDetail::new(
             "coverage-7d",
             "Cost coverage (last 7 days)",
@@ -151,7 +158,8 @@ fn totals_rows(totals: &Totals) -> Vec<Option<ProviderDisplayDetail>> {
         )
         .and_then(|row| {
             row.with_secondary_value(format!("{} partial", count(totals.partial_requests)))
-        }),
+        })
+        .and_then(|row| row.with_section_title("Last 7 days · this key")),
     ]
 }
 
diff --git a/rust/src/providers/aixy/tests.rs b/rust/src/providers/aixy/tests.rs
index 72175225b8..f0b6f6ecb9 100644
--- a/rust/src/providers/aixy/tests.rs
+++ b/rust/src/providers/aixy/tests.rs
@@ -85,12 +85,14 @@ fn key_usage_keeps_overlapping_budgets_and_reservations_separate() {
     assert_eq!(result.source_label, "api");
 
     assert_eq!(detail(&result, "key").value(), "Developer CLI");
+    assert_eq!(detail(&result, "key").section_title(), Some("Aixy key"));
     assert_eq!(detail(&result, "project").value(), "Engineering");
     assert_eq!(
         detail(&result, "observed").value(),
         "2026-09-24T12:00:00.000Z"
     );
     let hard = detail(&result, "budget-0");
+    assert_eq!(hard.section_title(), Some("Applicable budgets"));
     assert_eq!(hard.title(), "Project · Monthly · Shared · Hard");
     assert_eq!(hard.value(), "$70.00 / $100.00 remaining");
     assert_eq!(
@@ -106,6 +108,7 @@ fn key_usage_keeps_overlapping_budgets_and_reservations_separate() {
     assert_eq!(detail(&result, "tokens-7d").value(), "1,200");
     assert_eq!(detail(&result, "spend-7d").value(), "$1.25");
     let coverage = detail(&result, "coverage-7d");
+    assert_eq!(coverage.section_title(), Some("Last 7 days · this key"));
     assert_eq!(coverage.value(), "10 / 12 requests");
     assert_eq!(coverage.secondary_value(), Some("2 partial"));
 }
@@ -337,11 +340,11 @@ fn usage_url_supports_every_documented_base_form() {
         ),
         ("aixy.example.com", "https://aixy.example.com/v1/usage"),
         ("http://localhost:8080", "http://localhost:8080/v1/usage"),
-        ("http://10.1.2.3:8080/v1", "http://10.1.2.3:8080/v1/usage"),
         (
             "http://gateway.local/team",
             "http://gateway.local/team/v1/usage",
         ),
+        ("http://10.1.2.3:8080/v1", "http://10.1.2.3:8080/v1/usage"),
     ] {
         assert_eq!(usage_url(base).unwrap().as_str(), expected, "{base}");
     }