Let Core decide replay eligibility after WebSocket preludes or HTTP
keepalives. Persist subsequent attempts while still enforcing the running
lifecycle and consecutive attempt numbers, preserving delivery facts and
the upstream send watermark.
Cover retry metadata, duplicate and skipped attempts, and terminal request
immutability with a PostgreSQL regression test.
Co-authored-by: Codex <noreply@openai.com>
Start downstream keepalives while admitted streaming requests await their first output, including middleware processing. Separate transport commitment from the replay barrier so heartbeat frames preserve safe retries and execution accounting.
Co-authored-by: Codex <noreply@openai.com>
Include incomplete final outcomes in service health metrics and lower the
stable threshold to 95%. Keep the health popover at four outcomes by
folding incomplete requests into the service failure display.
Use consistent service success rates across dashboard trends, health
timelines and usage insights. Cover the reported counts, threshold edges,
caller exclusions and final success after failed attempts in regressions.
Refs #406
Co-authored-by: Codex <noreply@openai.com>
Add published GPT-6 Astra and GPT-6.1 Sol rates for short and long context. Expose Ultrafast override bands in the pricing API and editor, with billing and validation coverage.
Co-authored-by: Codex <noreply@openai.com>
The analytics worker acknowledged projected queue versions inside its
repeatable-read projection transaction. Request updates keep rewriting
pending queue rows through the source triggers, and once such a change
commits after the worker snapshot, the acknowledgement row lock fails with
a serialization error instead of skipping the stale version. Under steady
traffic every cycle rolled back the whole projection batch, the queue kept
growing and the worker stayed in backoff.
Commit the projection and publication first, then acknowledge the exact
versions in a separate read-committed transaction. Row locks there
re-check the latest committed version, so rewritten versions no longer
match and stay queued for replay, while locked rows are still skipped.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Preserve known model ownership when provider catalog refreshes fail.
Reject ambiguous unknown-provider routes and exclude ChatGPT OAuth
accounts from Grok requests while preserving API key passthrough.
Refs #391
Co-authored-by: Codex <noreply@openai.com>
Successful responses keep refreshing the quota observation time of the
account they used. The post-selection credential reload compared the
whole account snapshot, so a busy account could hit three observation-only
conflicts in a row and fail with account_snapshot_conflict before any
upstream request was sent.
Accept the reloaded snapshot when only the observation time of a
non-exhausted quota moved. Credential, state, scheduling, scope and quota
conclusion changes still invalidate the selection and retry as before.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Pause Runtime and SDK processing budgets while middleware delegates to host next, then resume the remaining budget. Preserve request deadlines and cancellation, share callback deadline state, and add timeout diagnostics and regression coverage.
Fixes#392
Co-authored-by: Codex <noreply@openai.com>
Hold PostgreSQL observation slots through connection cleanup and optimize exact usage pagination. Keep usage panels visible when analytics queries fail and backfill missing historical identity snapshots in one migration.
Co-authored-by: Codex <noreply@openai.com>
Fold migrations 0028 through 0035 into one migration while preserving every released migration through v3.23.1. Define the final observation validators, history schema, recovery leases, token columns, indexes, and analytics triggers once.
Refresh the migration manifest, remove superseded intermediate upgrade tests, and retain final-schema business validation. Verify clean installation, released-baseline upgrades, schema equivalence, and historical data using temporary PostgreSQL checks.
Co-authored-by: Codex <noreply@openai.com>
Prefer providers whose catalogs contain the mapped model before providers accepting unlisted models. Preserve account scope, route constraints, provider order within each tier, and unknown-model passthrough.
Add compiled mixed-catalog regressions and document candidate ordering. Refs #391.
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): preserve Lite interrupts across prelude retries
Deliver known Responses Lite WebSocket preludes before semantic output while retaining existing recovery guards. Keep interrupt intent across retries and retarget it only after the replacement response is delivered.
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): forward Lite events without waiting for output
Deliver unclassified Lite WebSocket events in order and reuse the existing commit boundary to stop replay after their delivery. Preserve error classification, retry budgets, account recovery, and interrupt handling.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Build durable request facts and bounded aggregate queries, freeze historical
identities, and move recovery lease updates out of request history rows.
Align token fields across storage, APIs and pages.
Invalidate analytics only after actual request deletions and track embedded
migration inputs during builds.
Co-authored-by: Codex <noreply@openai.com>
Record observed closure before terminal delivery can block, reject queued
unsent commands, and skip commands cancelled before socket writes.
Preserve connection diagnostics and test account egress across quota writes.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Add configurable privacy rules and shared previews for Codex metadata, Desktop context, request bodies and headers. Freeze policy per request and preserve atomic failure handling across HTTP and WebSocket transports.
Include settings presets, persistence, API contracts, migration and transport regressions.
Co-authored-by: Codex <noreply@openai.com>
Apply configured request locations to Desktop developer time contexts alongside environment contexts while preserving role and content-kind boundaries.
Cover date alignment, disabled overrides, proxy precedence, and HTTP/WebSocket requests. Update the location contract and troubleshooting documentation.
Co-authored-by: Codex <noreply@openai.com>
Allow HTTP API key base URLs for private networks and container services while retaining OAuth startup URL restrictions. Keep URL credential, query and fragment validation, and cover import, export and address rotation.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use the current host manifest format and require restart confirmation on
all management UI paths. Document v3.18.1 as the minimum online upgrade
source while retaining old release manifest reads for supported rollbacks.
Retire middleware v3 and upstream_adapter v1 Fast projections after their
compatibility window. Align SDK and host declarations with the current
contracts, keep risk warnings and per-instance failure isolation, and
exercise native fast_mode values through real plugin subprocesses.
Keep deployment, API and SDK documentation focused on current behavior.
Co-authored-by: Codex <noreply@openai.com>
Forward numeric and extended reasoning effort values and preserve standalone endpoint business headers.
Retain business metadata and original WebSocket text through provider, middleware, and client delivery. Validate rewritten plugin output without rejecting unchanged heartbeats or opaque messages.
Add HTTP, WebSocket, and plugin process regressions for the passthrough boundaries.
Co-authored-by: Codex <noreply@openai.com>
Record health component failures through operational diagnostics with transition deduplication. Preserve quota and catalog failure context without interrupting the account batch.
Co-authored-by: Codex <noreply@openai.com>
Forward non-create text frames unchanged over the original upstream WebSocket while preserving response.create admission and serialization. Keep the control transport available after completion and relay idle upstream events without creating another inference attempt.
Cover unknown frames, late interrupts, terminal settlement, binding revocation, and connection reuse.
Co-authored-by: Codex <noreply@openai.com>
Read response-scoped engine and API overhead metrics while excluding logical-turn totals and incomplete observations. Validate nested response IDs and cover the observed payload over SSE and WebSocket.
Co-authored-by: Codex <noreply@openai.com>
Extend the startup healthcheck grace period to five minutes and report elapsed migration time every fifteen seconds without changing published migrations.
Use one shutdown path for OS signals, internal cancellation, and managed restarts. Stop listening without waiting for active sessions, preserve bounded worker cleanup, and remove the obsolete connection drain timeout.
Cover shutdown entry points and worker cleanup with real HTTP lifecycle tests and document the deployment behavior.
Co-authored-by: Codex <noreply@openai.com>
Apply latest incremental tool declarations during Grok normalization and align nested Retry-After header parsing with official Codex semantics.
Cover developer instructions in input, Responses Lite tool declarations, partial_answer phases, and end_turn preservation.
Pin the upstream SQLx fix for cancelled BEGIN rollback and add a deterministic pooled-connection regression test.
Report safe Redis error categories and timeout status when the cooldown persistence regression fails.
Co-authored-by: Codex <noreply@openai.com>
Share unchanged prepared instances across extension sets and close each
process when its last owner releases it. Keep inflight request plans intact.
Unify migration recovery and publication, centralize authentication binding
validation, avoid duplicate package inspection, and separate middleware plans.
Validated with 292 admin, 182 runtime, 37 plugin storage and 15 architecture
tests, rustfmt, and strict workspace Clippy.
Co-authored-by: Codex <noreply@openai.com>
Remove version migration narratives, consolidate repeated explanations, and organize settings and architecture references.
Co-authored-by: Codex <noreply@openai.com>
Load account and API key group selectors through a lightweight admin options
endpoint while preserving pagination, filters, disabled groups and revision
metadata. Keep aggregate statistics on the group management endpoint.
Co-authored-by: Codex <noreply@openai.com>
Consolidate request diagnostics into typed request_observation_json with
migration 0025, preserving historical facts and query constraints.
Use upstream response timestamps for output throughput, align TTFT event
boundaries, and surface official timing metrics in the latency popover.
Co-authored-by: Codex <noreply@openai.com>
Give Guardian requests a separate per-account lease pool and wait queue while preserving ordinary concurrency and shared request intervals. Use the ordinary pool when the Guardian limit is zero, and align scheduling, diagnostics, settings copy, and documentation.
Co-authored-by: Codex <noreply@openai.com>
Check the recorded native continuation scope before selecting an account
or committing a session binding. Reuse the same scope validation after
middleware while preserving native connection checks and migration policy.
Cover ReplayOwner and ReplayAny with persisted provider metadata or a
connection-local pin, with and without an existing session binding.
Rejected replays must not acquire leases, write bindings or aliases, send
upstream requests, or redirect subsequent child requests.
Refs #364
Co-authored-by: Codex <noreply@openai.com>
Allow requests with a reliable session identity to claim a missing account
binding, including child threads and independent background tasks. Remove
the missing-binding wait queue while preserving existing migration rights
and bound-account waiting behavior.
Cover concurrent root/child claims, memory prewarm and turn reuse,
middleware identity changes, cancellation, and bound-account timeouts.
Update the documented strict-affinity contract.
Co-authored-by: Codex <noreply@openai.com>
Separate execution, provider ports, administration, and plugin lifecycle responsibilities.
Fix shutdown ordering, account lock reclamation, multipart cancellation, budget windows, and WebSocket close handling.
Align xAI catalog, reasoning, tools, replay, quota, and cost handling with current Grok contracts and remove legacy fallbacks.
Update API and architecture documentation with regression coverage. Validated backend suites, strict workspace Clippy, isolated PostgreSQL/Redis integration, and real Codex/Grok client flows.
Co-authored-by: Codex <noreply@openai.com>
Move observability query policies into Admin and reuse account state reads.
Bound Redis reads to measured batches and share protocol and transport helpers.
Close backup process and staging cleanup gaps, and remove unused entry points,
redundant models, dependencies, and obsolete tests.
Validated 3,526 workspace tests, then all 352 Store tests after batch tuning,
plus strict workspace Clippy and formatting checks. Local release benchmarks
cover concurrent account reads and controlled transport delays.
Co-authored-by: Codex <noreply@openai.com>
Count non-preamble Responses events for first-token timing while preserving
semantic output boundaries and request-level timing origins. Calculate
output throughput over the complete request duration in usage rows and
aggregate queries.
Co-authored-by: Codex <noreply@openai.com>
Route relaxed requests through the configured scheduler and keep the session primary during preferred-mode spillover. Default new settings to strict while preserving saved modes.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
think-backandClaude Opus 5.5
dependabot[bot]
ZyyandCodex
hi_yuebanandCodex
ZyyandCodex