Rank quota scheduling strictly by configured reset windows and persist its settings independently from smart scheduling.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Resolve explicit Claude session identities before account selection and
revalidate them after attempt middleware using the existing affinity policy.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Apply the global request profile to account catalog discovery, warmup,
and diagnostic routing. Freeze each operation's identity through the
existing provider profile resolver.
Refresh verified offline releases and centralize their version, artifact,
and environment defaults. Cover ZIP64 MSIX metadata and keep release
update tests independent of the current bundled versions.
Fixes#703
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(settings): remove request history retention cap
Allow positive retention days beyond 31 throughout the form, domain rules,
and database constraint. Keep the existing default and saved settings.
Bound cleanup and account usage queries by stored data so large retention
windows remain safe without expanding empty history.
Co-authored-by: Codex <noreply@openai.com>
* test(admin): align retention policy coverage with positive windows
Accept long request retention windows while preserving zero rejection
for each target and independent event and audit retention settings.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Make event delivery respond to downstream cancellation and pool shutdown. Return or discard sockets before publishing terminal events while preserving normal connection reuse.
Co-authored-by: Codex <noreply@openai.com>
Match independently scheduled hour and minute pairs while claiming each local minute once. Keep the existing string setting and database constraint, and edit the rules as tags using UI v0.11.0.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use the last successful catalog for the same account, credential revision, and plan until a refresh replaces it. Apply the same exclusions in memory and in PostgreSQL while preserving explicit allowlists and accounts with no catalog.
Co-authored-by: Codex <noreply@openai.com>
Use UI v0.10.1 so built-in presets tint pages and cards while preserving explicit background and semantic color settings.
Co-authored-by: Codex <noreply@openai.com>
* fix(egress): honor deployment proxies for unbound outbound requests
Prefer the proxy selected for the request. Otherwise apply the deployment proxy and bypass rules consistently to HTTP and WebSocket connections, including background downloads. Keep explicit direct probes separate.
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): preserve WebSocket dial errors
Recover the OS error or I/O kind from Hyper without retaining the endpoint. Keep refused connections distinguishable for both direct and proxied WebSocket dials.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* fix(update): unlock official plugin dirs before rename on macOS
macOS rejects renaming a 0555 official plugin directory during backup
and rollback, while Linux only needs the parent writable.
Co-authored-by: Cursor <cursoragent@cursor.com>
* fix(update): preserve directory permissions during macOS moves
Fall back to the existing permission-preserving copy path when macOS
rejects a directory rename. Keep chmod limited to source cleanup so
backups and restored releases retain their original directory modes.
Cover read-only staged assets, rollback, failed replacement, and
cancelled or rejected rollback with permission assertions.
Co-authored-by: Codex <noreply@openai.com>
* fix(update): handle read-only directory moves across Unix platforms
Linux also requires source directory write permission when rename moves
it between parents. Apply the same copy fallback to Unix while retaining
the cross-platform permission regression test.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: CzsGit <czsde@outlook.com>
Co-authored-by: Cursor <cursoragent@cursor.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use each upstream handshake's message-size limit to select HTTP before
uploading oversized response.create frames. Remove fixed thresholds and
thread size hysteresis while preserving continuation replay and cleanup.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Separate protocol identifiers from Provider identities and centralize shared
request facts and observations in gateway-protocol. Keep endpoint models
and private continuation state owned by Providers.
Reorganize the architecture documentation and clarify the shutdown guarantees
for buffered charges and observations.
Validated with workspace formatting, strict Clippy, 3013 affected-module
tests and 16 architecture checks. One reference-binary TLS test is ignored.
Co-authored-by: Codex <noreply@openai.com>
Observe top-level output_config.effort before the OpenAI encoder rejects
Messages payloads. Reuse the protocol parser without inferring an effort
from thinking budgets or changing upstream conversion behavior.
Cover absent and explicit effort values, native Messages forwarding, and
Messages-to-Responses conversion. Document the observation contract.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): rotate new round-robin sessions without affinity hits
Strict affinity keeps a session on one account, but the shared request
cursor advanced on every scheduling load, including affinity hits. A new
session then took whatever slot that request volume happened to leave.
Advance a separate session cursor only when round-robin assigns an
account, and keep the request cursor for other strategies.
* fix(openai): advance round robin when an account assignment succeeds
Commit the session binding and round-robin cursor together after acquiring the account lease. Release a conflicting lease before retrying so concurrent first requests share a binding without consuming extra turns. Count delegated selections and preserve explicit plugin picks.
Verified with OpenAI provider tests, store tests against Redis and PostgreSQL, architecture checks, and workspace Clippy.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: koeria <riennie@qq.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Treat x-retry-metadata: NO_MORE_RETRY as a hard signal to skip
same-account backoff and transport recovery, even when Retry-After
is within maxRetryAfterSeconds. Capacity failures still rotate under
the existing policy; server_error still returns the upstream error.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Reuse connection-scoped peer discovery for native HTTP and WebSocket forwarding. Strip the route header for ordinary upstreams and leave explicit plugin forwarding changes to plugins.
Co-authored-by: Codex <noreply@openai.com>
Compare native HTTP, custom CA HTTP, and WebSocket ClientHello captures with an official Codex executable on the same platform. Document the explicit reference test workflow.
Co-authored-by: Codex <noreply@openai.com>
Limit default tier omission to Messages-to-OAuth conversion so native Responses retain their requested tier and routing hint.
Co-authored-by: Codex <noreply@openai.com>
Persist validated directories per credential revision. Restore them in bulk and refresh only missing, expired, or changed accounts with paced background requests. Filter large pools using current per-account evidence while preserving unknown and explicitly allowed candidates.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
David Lee
github-actions[bot]
