Let OpenAI accounts send explicitly allowlisted model IDs upstream while retaining catalog checks for other accounts. Update the account editor and connection test to support custom IDs.
Co-authored-by: Codex <noreply@openai.com>
Count incomplete requests as errors, exclude recovered and cancelled requests from success rates, and preserve gaps for missing samples.
Co-authored-by: Codex <noreply@openai.com>
Distinguish connection failures from uncertain authorization results and retain redacted diagnostic causes. Increase token connection timeout to 30 seconds and total request timeout to 60 seconds.
Co-authored-by: Codex <noreply@openai.com>
Notify idle clients with Close 1000 after upstream loss while preserving settlement and queued requests. Align idle transport termination detection with Codex and document the reconnect contract.
Co-authored-by: Codex <noreply@openai.com>
Read the local running version during bootstrap without waiting for a
remote release check. Reuse the restart handoff pipe on Unix so the
replacement starts as soon as the old service releases its resources.
Keep shutdown cleanup budgets and bounded listener retries. Update the
handoff regression coverage and lifecycle documentation.
Validation: Rustfmt, strict workspace Clippy, 252 Host and bootstrap
tests, and isolated Linux startup and consecutive restart measurements.
Co-authored-by: Codex <noreply@openai.com>
Share binary builds and dependency caches, run Windows platform checks in parallel, and reuse verified CI evidence for version-only releases. Reuse prebuilt CI image inputs and add read-only release preflight.
Co-authored-by: Codex <noreply@openai.com>
Avoid validating model access and plugin forms when switching modes.
Keep error protection drafts quiet until input or submission, and retain
condition identity when editing or removing entries.
Co-authored-by: Codex <noreply@openai.com>
Preserve client-supplied turn state on full requests with unknown ownership
and remove the process-local proof cache. Keep confirmed account-switch
cleanup and existing continuation authorization boundaries.
Cover HTTP and WebSocket retries, provider recreation, expired affinity,
and conflicting account ownership; update the API and architecture docs.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): test account egress and assign accounts in bulk
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): refine proxy controls and quota display
Keep egress results with their proxy options and refresh stale proxy revisions before retrying. Compact account assignment and settings controls, and hide missing quota refresh timestamps.
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): reset account selection without closing dialog
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): clarify assignment reset and unavailable accounts
Use a red reset button and disabled checkboxes for accounts already using the target proxy.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): show account details in assignment dialog
Add platform, subscription, and group columns, remove inline provider icons, and use the existing subtle danger style for reset.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Clear the peer badge when the upstream explicitly disables sharing or does not support CPR Link. Preserve identity on transient failures and allow manual rediscovery from the quota panel.
Co-authored-by: Codex <noreply@openai.com>
Map tool-result names, inline PDF inputs, and hosted web search to Responses. Project URL citations into Chat messages and preserve the requested output token limit in the OpenAI encoder.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Carry the freeze recovery target into provider account selection so probe responses cannot update credentials or clear the active protection. Let the recovery worker postpone or release the same freeze after observing the upstream result.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Expose /readyz for the runtime snapshot, PostgreSQL, and Redis. Keep worker and logging diagnostics on /healthz so a maintenance failure can alert without removing a serving instance from service discovery.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use a fresh upstream key concurrency limit as the account default for scheduling, leases, and capacity reporting. Show disclosed limits alongside the upstream pool summary.
BREAKING CHANGE: Both peers must support CPR Link schema v3.
Refs: #587
Co-authored-by: Codex <noreply@openai.com>
* fix(update): keep read-only official plugin files during extract
Docker Desktop returns EPERM when chmod runs again on an official plugin file that tar already unpacked as mode 0444.
Fixes#594
* test(update): cover writable official plugin archives
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: le-czs <243511553+le-czs@users.noreply.github.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve account profiles and quota observations during OAuth refresh and retry deferral. Project rolling daily usage independently of upstream snapshots and expose its period through the existing account usage API.
Keep quota capacity forecasts scoped to weekly and monthly windows. Cover refresh persistence, daily statistics, API projection, and PostgreSQL CAS behavior.
Co-authored-by: Codex <noreply@openai.com>
Keep oversized Codex threads on SSE until a full request falls below 13.5 MiB. After delivering a response that requires full replay, close an idle Codex socket so the next step can send its history directly.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
ZyyandZyy
蓝芷怡andCodex
dependabot[bot]
