Send upstream Ping frames every 25 seconds without a Pong deadline.
Keep downstream cancellation, business idle timeout and pool eviction
independent from heartbeat traffic, with bounded heartbeat writes.
Co-authored-by: Codex <noreply@openai.com>
Return catalog refresh failures to the host supervisor so queued ETags use the existing restart backoff. Preserve failure causes and report recovery only after a successful refresh.
Co-authored-by: Codex <noreply@openai.com>
* fix(usage): keep optional concurrency scans within a bounded budget
Skip unused concurrency work for Key usage and Dashboard trends. Preserve
other insights when exact concurrency exceeds its row, time, or slot budget.
Constraint: Preserve exact overlap semantics and one snapshot for usage metrics
Rejected: Add hourly peaks or truncate intervals | Neither preserves exact concurrency
Confidence: medium
Scope-risk: moderate
Directive: Keep unavailable concurrency distinct from a measured zero
Tested: Rust 1.99.1 rustfmt on changed Rust files; git diff --check; independent source review
Not-tested: PostgreSQL integration, Clippy, and frontend checks pending isolated CI
Co-authored-by: Codex <noreply@openai.com>
* refactor(analytics): limit concurrency changes to unused results
Keep Key usage and Dashboard skip behavior while retaining the existing concurrency calculation and query budget.
Co-authored-by: Codex <noreply@openai.com>
* perf(usage): query insight cards by selected metric
Split health, performance and cost reads by card and selected metric, with independent frontend requests and metric-aware caching. Only the load metric reads concurrency.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Remove the per-response model catalog byte cap while keeping native
catalog cache residency bounded to 32 MiB.
Carry parent WebSocket routing cookies into Guardian reviews within the
same client key and OAuth account. Isolate reviewer sockets by routing
snapshot and preserve cookie expiry across pooled parent connections.
Co-authored-by: Codex <noreply@openai.com>
Return response.interrupt.failed for supported interrupts when no upstream control channel is bound, so clients can drain the genuine response and continue. Preserve existing errors for unsupported controls and ambiguous sends.
Cover active, settling, and idle HTTP responses and queued request admission. Document the rejection contract while retaining the oversized request protection.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep unsaved settings and their revision when the management API rejects a
request with a structured 4xx response. Continue reconciling settings for
uncertain write outcomes, including transport failures and server errors.
Co-authored-by: Codex <noreply@openai.com>
Scan completed scheduled backups in bounded pages and evaluate retention
against their global positions. Collect a deletion batch before deleting
records so cleanup does not shift its own later page offsets.
Cover count and age thresholds beyond 1000 records and PostgreSQL page
ordering with tied completion times.
Co-authored-by: Codex <noreply@openai.com>
Use transparent help triggers and keep note text styling stable.
Show notes in account dialogs and simplify upstream labels.
Keep settings navigation segmented on narrow screens.
Co-authored-by: Codex <noreply@openai.com>
Track inbound byte progress before WebSocket decoding so active uploads do not trip the heartbeat timeout. Reuse Axum handshake validation and report actual receive idle time.
Cover successive slow uploads and stalled partial frames, and document the downstream liveness contract.
Validation: 652 API and gateway tests passed; production API check, strict workspace Clippy, and formatting passed.
Co-authored-by: Codex <noreply@openai.com>
Raise the session affinity storage budget to 500ms while keeping cyber policy operations on a separate 100ms budget. Preserve fail-closed binding behavior and cover delayed admission and timeout rejection before upstream sending.
Refs #549
Co-authored-by: Codex <noreply@openai.com>
Return non-retryable client version errors and correct provider error types.
Keep safe user messages separate from operational diagnostics.
Unify error wording and document the conventions in the development skill.
Co-authored-by: Codex <noreply@openai.com>
Use passive upstream heartbeats and independent downstream liveness checks.
Reclaim unbound sockets after five idle minutes and release client-owned
resources on disconnect, with safe continuation ownership transfer.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): support configurable error protection rules
Replace capacity-specific freezing with bounded, configurable account error rules and shared attempt feedback.
Drop legacy settings without conversion and expose rule editing and freeze reasons in the admin UI.
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): preserve error protection scheduling boundaries
Keep xAI accounts excluded while recovery probes are pending, and cover
selection before and after recovery.
Separate scheduling cooldown reads from admin display details, share the
atomic Redis migration and selection logic, and use one policy revision.
Remove the unused adaptive concurrency reduction path and its tests.
Validation: 393 targeted backend tests, workspace Clippy with -D warnings,
Rustfmt, frontend type checking and build, and local service health checks.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Recognize official TUI, exec, IDE, SDK and App Server/MCP product names using the Core version in the User-Agent. Keep Desktop app version handling and unknown-client compatibility intact.
Compare SemVer precedence without build metadata, cover HTTP/SSE and real WebSocket admission, and align API documentation and localized settings help.
Validated 54 targeted and architecture tests, strict Clippy, Rust formatting, frontend lint/build, and localized component previews.
Co-authored-by: Codex <noreply@openai.com>
Remove inline loading failure placeholders and dedicated retry actions from
settings, accounts, plugins and usage views. Route foreground failures through
existing notifications while preserving disabled controls and available data.
Clean up obsolete error props, state and translations.
Co-authored-by: Codex <noreply@openai.com>
* feat(usage): add request concurrency trends
* perf(usage)!: unify load insights and optimize concurrency
Aggregate concurrency on a single event timeline and reuse lifecycle
indexes instead of joining every request against every time bucket.
Align load summaries and trend points with the four chart metrics,
combine concurrency and scheduling in one view, and right-align the
statistics card selectors. Update the API contract and regression tests.
BREAKING CHANGE: Usage insights concurrency and scheduling P95 fields
move under performance.load and performance.points[].load. Unused
scheduling P50, capacity, and performance coverage fields are removed.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Centralize account authentication, plan and model eligibility for Images and Live. Reuse the same checks before leases, affinity and retries, while preserving unknown plans and Free text/search access.
Co-authored-by: Codex <noreply@openai.com>
Resolve reasoning effort from configuration updates and preserve overrides in response-scoped session metadata without rewriting upstream requests. Cover HTTP and WebSocket continuations, new-chain resets, and baseline changes.
Co-authored-by: Codex <noreply@openai.com>
Include the realtime WebSocket base URL in generated Codex configuration and document voice setup. Simplify configuration comments.
Track key reveal actions separately so opening client configuration and copying a key show loading only on the initiating button. Preserve duplicate request protection and stale request cancellation.
Co-authored-by: Codex <noreply@openai.com>
Enable remote model discovery for custom Codex providers so upstream catalog updates appear in the model picker.
Co-authored-by: Codex <noreply@openai.com>
Keep direct aliases in v2 and update the SDK builder, runtime compatibility declaration, tests and migration guidance.
BREAKING CHANGE: model_catalog plugins must declare version 2, move their alias list to aliases and return models for adapted models.
Co-authored-by: Codex <noreply@openai.com>
Simplify group filters and keep date and platform controls aligned. Apply quota warning thresholds independently to each window and move account batch actions into a compact menu.
Co-authored-by: Codex <noreply@openai.com>
Include published standard, flex, priority, and long-context prices in the built-in catalog and classify Terra as a reasoning model for preview web search billing.
Co-authored-by: Codex <noreply@openai.com>
Match account names and emails, client key names and labels, and observability search fields by literal substrings. Preserve wildcard escaping and existing case rules.
Co-authored-by: Codex <noreply@openai.com>
* feat(plugin): publish account-scoped adapted model catalogs
* fix(core): preserve candidate account scope during execution
Apply the narrowed candidate scope before provider account selection, including affinity and account rotation. Cover adapted-only models and same-name models with incompatible tool capabilities through the real OpenAI selector and local HTTP fixtures.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Seal managed callback observations before Core retry decisions and synchronize RPC resource revocation with stream teardown.
Co-authored-by: Codex <noreply@openai.com>
Keep incompatible plugins out of execution sets during automatic startup.
Require scoped confirmation for manual compatibility overrides and show
the stopped state and upgrade effects in the management UI.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
Mason MaandCodex
Yuqi Xiong
蓝芷怡andCodex
niceSprite