Track bounded ownership proofs for upstream turn-state tokens, including failed responses, so same-turn full requests can echo them without trusting unrelated account state.
Co-authored-by: Codex <noreply@openai.com>
Build x64 and ARM64 release archives with a static MSVC runtime.
Support executable replacement, restart handoff and rollback on Windows.
Co-authored-by: Codex <noreply@openai.com>
Use current peer summaries for request records and account diagnostics without changing historical snapshots or database schema.
Co-authored-by: Codex <noreply@openai.com>
Track hosted search initialization on pooled Codex sockets and retire incompatible connections before sending. Preserve existing client full replay recovery for connection-local deltas.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Reuse account plan resolution when exporting peer pool summaries. Read saved quota observations for missing plans even when quota sharing is disabled, without exposing quota data or mutating account records.
Cover unknown and missing plans, subtype preservation, plan-only limits, and quota refresh from an unknown account plan.
Co-authored-by: Codex <noreply@openai.com>
Require the official model_not_found code and supported status codes for
account-model cooldowns. Treat unsupported_value as a terminal request
error and preserve account eligibility across HTTP, SSE, and WebSocket.
Co-authored-by: Codex <noreply@openai.com>
Apply valid catalog membership alongside account model access for native OAuth, API key upstreams, and xAI. Preserve upstream validation for missing catalogs and unknown plans.
Co-authored-by: Codex <noreply@openai.com>
Read up to 128 accounts per Redis script while preserving input order, pool isolation, shared scheduling timestamps, expiry cleanup, and error propagation. Extend real Redis coverage for mixed lease states and invalid batch data.
Co-authored-by: Codex <noreply@openai.com>
Filter known OAuth models by fresh plan catalogs and retain account-scoped model rejections. Preserve credential, transport, adapter, and continuation boundaries, and combine cooldown expiry without dropping protection semantics.
Co-authored-by: Codex <noreply@openai.com>
Remove obsolete and redundant assertions while preserving current behavior.
Optimize zlib-rs in dev/test builds and use eight concurrent CI test workers.
Use explicit time bases and synchronization for integration fixtures.
Validated 4322 tests, 72 Redis ACL tests, and ten stress iterations of 102
concurrency-related tests. Rustfmt, strict Clippy, and actionlint passed.
Co-authored-by: Codex <noreply@openai.com>
Organize backend modules by responsibility, simplify runtime layers, and
keep shared contracts with their owning modules. Split frontend account
APIs and separate shared types from request implementations.
Strengthen architecture checks for module dependencies and test layout.
Co-authored-by: Codex <noreply@openai.com>
Persist unsupported CPR Link detection for each connection and skip periodic
probes across restarts. Retain manual rediscovery, connection invalidation,
retry throttling, and existing quota access protections.
Log stale response-cookie revision conflicts at debug while retaining
warnings for actual storage failures.
Validation: 29 peer-related tests, 14 cookie tests, 16 architecture checks,
strict Clippy, Rustfmt, and diff checks passed.
Co-authored-by: Codex <noreply@openai.com>
Make capability blocks optional and represent key budgets as named windows. Centralize validation and preserve unknown states for missing observations.
BREAKING CHANGE: CPR Link requires schema_version 2; v1 snapshots are no longer accepted.
Co-authored-by: Codex <noreply@openai.com>
Remove tracing headers and their WebSocket metadata copies through the existing correlation cleanup. Cover cache identity stability and WebSocket reuse after privacy header changes.
Co-authored-by: Codex <noreply@openai.com>
Share a four-request limit across CPR discovery, manual refreshes, and
periodic refreshes, and avoid loading runtime settings for initial reads.
Reuse account name and notes fields for import and editing, apply custom
names only to single-account imports, and match API usage bars to quota
progress styling.
Co-authored-by: Codex <noreply@openai.com>
Allow local account names to be changed or cleared without replacing credentials or account settings. Show the name with notes and fall back to email when the name is empty.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Store peer snapshots in existing account quota fields and remove dedicated node and synchronization tables. Keep CPR protocol handling in Admin and native quota handling in Providers, sharing persistence and the quota refresh endpoint.
Use runtime refresh coordination and preserve credential, connection, and observation-time guards. Update the unreleased migration, API contracts, documentation, and regression coverage.
Validated with 354 selected tests, strict workspace Clippy, Rustfmt, frontend lint and build, and migration checksum verification. Browser interaction remains unverified.
Co-authored-by: Codex <noreply@openai.com>
Export authoritative budget access flags and keep monetary fields display-only
for peer consumers. Use the official usage_limit_reached error type for budget
exhaustion while preserving ordinary rate-limit cooldowns.
Apply fresh quota facts atomically with peer snapshots through the shared quota
writer, retaining connection, claim, and observation-time guards. Reuse the
existing sync worker and document the recovery contract.
Validated with 234 selected tests, strict workspace Clippy, and Rustfmt.
Co-authored-by: Codex <noreply@openai.com>
* feat(peer): add automatic discovery and scalable quota sharing
Export authorized direct-account pools and budgets through the CPR peer
protocol, with durable upstream discovery and immutable scheduling views.
Show shared-pool node quotas through common quota popovers and lazy account
details. Bound snapshot reads and export concurrency, reduce Redis and SQL
work, and keep only the latest observation for each upstream connection.
Co-authored-by: Codex <noreply@openai.com>
* refactor(peer): centralize upstream discovery and quota projections
Move peer synchronization into Admin, HTTP transport into Host, and expose
neutral Core scheduling signals through explicitly wired provider capabilities.
Preserve provider-visible model catalogs and independent quota disclosure,
with stale windows following the existing OAuth quota layout.
Cover cross-provider discovery, lifecycle fencing, and database leases, and
update the architecture and usage documentation.
Co-authored-by: Codex <noreply@openai.com>
* fix(ui): center usage card loading and empty states
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): unify peer subscription badges across account views
Share CPR identity rendering through AccountPlanBadge, project upstream metadata into dashboard and proxy account views, and align quota empty states and API badges.
Co-authored-by: Codex <noreply@openai.com>
* fix(peer): bound snapshot work and preserve quota windows
Keep summary reads off full snapshots, reject oversized model expansion early, and yield export work. Preserve daily and weekly unlimited budgets, hide empty token counters, and unify quota empty states.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve authentication snapshots for diagnostic account badges and align
account note typography. Hide unavailable dashboard quotas consistently
and show available quota rates independently of local request counts.
Co-authored-by: Codex <noreply@openai.com>
Send upstream Ping frames every 25 seconds without a Pong deadline.
Keep downstream cancellation, business idle timeout and pool eviction
independent from heartbeat traffic, with bounded heartbeat writes.
Co-authored-by: Codex <noreply@openai.com>
Return catalog refresh failures to the host supervisor so queued ETags use the existing restart backoff. Preserve failure causes and report recovery only after a successful refresh.
Co-authored-by: Codex <noreply@openai.com>
* fix(usage): keep optional concurrency scans within a bounded budget
Skip unused concurrency work for Key usage and Dashboard trends. Preserve
other insights when exact concurrency exceeds its row, time, or slot budget.
Constraint: Preserve exact overlap semantics and one snapshot for usage metrics
Rejected: Add hourly peaks or truncate intervals | Neither preserves exact concurrency
Confidence: medium
Scope-risk: moderate
Directive: Keep unavailable concurrency distinct from a measured zero
Tested: Rust 1.99.1 rustfmt on changed Rust files; git diff --check; independent source review
Not-tested: PostgreSQL integration, Clippy, and frontend checks pending isolated CI
Co-authored-by: Codex <noreply@openai.com>
* refactor(analytics): limit concurrency changes to unused results
Keep Key usage and Dashboard skip behavior while retaining the existing concurrency calculation and query budget.
Co-authored-by: Codex <noreply@openai.com>
* perf(usage): query insight cards by selected metric
Split health, performance and cost reads by card and selected metric, with independent frontend requests and metric-aware caching. Only the load metric reads concurrency.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Remove the per-response model catalog byte cap while keeping native
catalog cache residency bounded to 32 MiB.
Carry parent WebSocket routing cookies into Guardian reviews within the
same client key and OAuth account. Isolate reviewer sockets by routing
snapshot and preserve cookie expiry across pooled parent connections.
Co-authored-by: Codex <noreply@openai.com>
Return response.interrupt.failed for supported interrupts when no upstream control channel is bound, so clients can drain the genuine response and continue. Preserve existing errors for unsupported controls and ambiguous sends.
Cover active, settling, and idle HTTP responses and queued request admission. Document the rejection contract while retaining the oversized request protection.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Scan completed scheduled backups in bounded pages and evaluate retention
against their global positions. Collect a deletion batch before deleting
records so cleanup does not shift its own later page offsets.
Cover count and age thresholds beyond 1000 records and PostgreSQL page
ordering with tied completion times.
Co-authored-by: Codex <noreply@openai.com>
Track inbound byte progress before WebSocket decoding so active uploads do not trip the heartbeat timeout. Reuse Axum handshake validation and report actual receive idle time.
Cover successive slow uploads and stalled partial frames, and document the downstream liveness contract.
Validation: 652 API and gateway tests passed; production API check, strict workspace Clippy, and formatting passed.
Co-authored-by: Codex <noreply@openai.com>
Raise the session affinity storage budget to 500ms while keeping cyber policy operations on a separate 100ms budget. Preserve fail-closed binding behavior and cover delayed admission and timeout rejection before upstream sending.
Refs #549
Co-authored-by: Codex <noreply@openai.com>
Return non-retryable client version errors and correct provider error types.
Keep safe user messages separate from operational diagnostics.
Unify error wording and document the conventions in the development skill.
Co-authored-by: Codex <noreply@openai.com>
Use passive upstream heartbeats and independent downstream liveness checks.
Reclaim unbound sockets after five idle minutes and release client-owned
resources on disconnect, with safe continuation ownership transfer.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): support configurable error protection rules
Replace capacity-specific freezing with bounded, configurable account error rules and shared attempt feedback.
Drop legacy settings without conversion and expose rule editing and freeze reasons in the admin UI.
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): preserve error protection scheduling boundaries
Keep xAI accounts excluded while recovery probes are pending, and cover
selection before and after recovery.
Separate scheduling cooldown reads from admin display details, share the
atomic Redis migration and selection logic, and use one policy revision.
Remove the unused adaptive concurrency reduction path and its tests.
Validation: 393 targeted backend tests, workspace Clippy with -D warnings,
Rustfmt, frontend type checking and build, and local service health checks.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Recognize official TUI, exec, IDE, SDK and App Server/MCP product names using the Core version in the User-Agent. Keep Desktop app version handling and unknown-client compatibility intact.
Compare SemVer precedence without build metadata, cover HTTP/SSE and real WebSocket admission, and align API documentation and localized settings help.
Validated 54 targeted and architecture tests, strict Clippy, Rust formatting, frontend lint/build, and localized component previews.
Co-authored-by: Codex <noreply@openai.com>
Ke WangandCodex
ZyyandCodex
dependabot[bot]
Mason MaandCodex
Yuqi Xiong
蓝芷怡andCodex