Use event-listener registrations that unregister when cancellation futures
are dropped, including waits attached to ancestor tokens. Recheck the
cancelled flag after registration to preserve wakeups during races.
Add allocation regressions for select churn and child cancellation, plus
broadcast and concurrent cancellation coverage.
Refs #338, #345
Co-authored-by: Codex <noreply@openai.com>
Allow long model responses to finish without a fixed 600-second deadline,
while preserving explicit plugin deadlines and upstream idle timeouts.
Renew request recovery, client admission and provider scheduling leases
for the session lifetime, and release their renewal tasks with the owners.
Keep observation renewal best-effort and cancel on lost concurrency leases.
Fixes#342
Co-authored-by: Codex <noreply@openai.com>
Configure Guardian reservations through persisted runtime settings and frozen request policies. Combine concurrency controls and queues in the admin UI, with the scheduling strategy shown first.
Prioritize Guardian account waiters, recheck displaced queue heads before lease acquisition, and report request-specific available capacity. Preserve account, key and wait-budget limits.
Co-authored-by: Yongzhao Chen <yongzhao.derek@gmail.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Codex <noreply@openai.com>
Assert the UTC PostgreSQL timezone and runtime timezone configured by the deployment files. Keep the application business timezone independent from the infrastructure checks.
Co-authored-by: Codex <noreply@openai.com>
Keep modal content and request state stable until the exit transition completes, and defer credential cleanup until after leave. Update the UI dependency and submodules to v0.3.2, including the plugin workbench consumer.
Co-authored-by: Codex <noreply@openai.com>
Use one validated IANA timezone for backend display projections, calendar queries, budget windows, warmup slots, backups, and logs. Remove frontend date formatting and the independent backup timezone setting.
Preserve UTC instants and active budget windows, persist warmup deduplication, and advance backup schedules transactionally. Cover DST boundaries, timezone changes, invalid calendar anchors, and account cooldown displays.
Co-authored-by: Codex <noreply@openai.com>
Expose upstream credit facts through the account quota API while preserving
decimal balances and distinguishing zero, unlimited, and missing values.
Clear stale balances on passive updates without changing quota availability.
Display credits below reset cards, label OpenAI quota as Codex quota, and
standardize the account quota action icons.
Co-authored-by: Codex <noreply@openai.com>
Restore the pre-window host implementation and document plugin-owned policy and presentation. Keep native reset RPC coverage and run plugin integration tests with the standard isolated test services.
Co-authored-by: Codex <noreply@openai.com>
Move the quota forecast entry after reset credits and propagate account updates from the quota panel. Include each error account current subscription in troubleshooting and unify subscription labels.
Co-authored-by: Codex <noreply@openai.com>
Size diagnostic names by dimension and share available width across metric columns. Keep API key names compact.
Co-authored-by: Codex <noreply@openai.com>
Update the admin UI dependency and lockfile, and align the UI and plugin submodules with the released modal fix.
Co-authored-by: Codex <noreply@openai.com>
Use all matching requests for diagnostic shares and count retried requests once. Show current account plans in diagnostics and request records with compact, aligned columns.
Simplify quota forecasts and remove unused remaining-capacity response fields. Open system updates immediately with the existing loading skeleton and clip masked key prefixes without an ellipsis.
Co-authored-by: Codex <noreply@openai.com>
Validate the v2 host declaration while retaining the v1 release envelope, and sync the plugin submodule to stable v0.2.0.
Co-authored-by: Codex <noreply@openai.com>
Compose HTTP, WebSocket, request, attempt and public service calls through
shared onion middleware with scoped settings and invocation context.
Adopt trusted-process manifests, unified observation and forward-compatible
SDK contracts. Align management UI, documentation and the workbench reference.
Preserve native response bytes and WebSocket failure lifecycles.
Co-authored-by: Codex <noreply@openai.com>
Validate Cargo mount snapshots before saving, group cache tooling in a local action, and decouple image builds from release packaging. Use prebuilt security tooling and narrow unrelated CI triggers.
Co-authored-by: Codex <noreply@openai.com>
Reuse immutable plugin archives across nextest processes and share admin fixtures within test matrices. Reduce log scanning, hashing, compression, database setup, and SSE scanning costs while preserving isolation and boundary coverage.
Use controllable clocks for recovery budgets and quota scheduling, retaining real socket and HTTP verification.
Validation: 3200 backend tests, 132 plugin persistence tests, 54 Redis ACL tests, 30 clock stress iterations, clippy, and formatting checks passed. Local full-suite runtime improved from 182.8s to 74.0s at unchanged concurrency.
Co-authored-by: Codex <noreply@openai.com>
Keep documentation focused on current behavior and clear ownership.
Load skill references by task and clarify official source priority and reply tone.
Co-authored-by: Codex <noreply@openai.com>
Resolve and retain the executable path at startup so updates, rollbacks and
restarts keep using the installation path after the running binary is renamed.
Document binary self-restart configuration and cover renamed executable restarts.
Refs #316
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
WeiSiTaPanandCodex
dependabot[bot]
