Send upstream Ping frames every 25 seconds without a Pong deadline.
Keep downstream cancellation, business idle timeout and pool eviction
independent from heartbeat traffic, with bounded heartbeat writes.
Co-authored-by: Codex <noreply@openai.com>
* fix(usage): keep optional concurrency scans within a bounded budget
Skip unused concurrency work for Key usage and Dashboard trends. Preserve
other insights when exact concurrency exceeds its row, time, or slot budget.
Constraint: Preserve exact overlap semantics and one snapshot for usage metrics
Rejected: Add hourly peaks or truncate intervals | Neither preserves exact concurrency
Confidence: medium
Scope-risk: moderate
Directive: Keep unavailable concurrency distinct from a measured zero
Tested: Rust 1.99.1 rustfmt on changed Rust files; git diff --check; independent source review
Not-tested: PostgreSQL integration, Clippy, and frontend checks pending isolated CI
Co-authored-by: Codex <noreply@openai.com>
* refactor(analytics): limit concurrency changes to unused results
Keep Key usage and Dashboard skip behavior while retaining the existing concurrency calculation and query budget.
Co-authored-by: Codex <noreply@openai.com>
* perf(usage): query insight cards by selected metric
Split health, performance and cost reads by card and selected metric, with independent frontend requests and metric-aware caching. Only the load metric reads concurrency.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Remove the per-response model catalog byte cap while keeping native
catalog cache residency bounded to 32 MiB.
Carry parent WebSocket routing cookies into Guardian reviews within the
same client key and OAuth account. Isolate reviewer sockets by routing
snapshot and preserve cookie expiry across pooled parent connections.
Co-authored-by: Codex <noreply@openai.com>
Return response.interrupt.failed for supported interrupts when no upstream control channel is bound, so clients can drain the genuine response and continue. Preserve existing errors for unsupported controls and ambiguous sends.
Cover active, settling, and idle HTTP responses and queued request admission. Document the rejection contract while retaining the oversized request protection.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Track inbound byte progress before WebSocket decoding so active uploads do not trip the heartbeat timeout. Reuse Axum handshake validation and report actual receive idle time.
Cover successive slow uploads and stalled partial frames, and document the downstream liveness contract.
Validation: 652 API and gateway tests passed; production API check, strict workspace Clippy, and formatting passed.
Co-authored-by: Codex <noreply@openai.com>
Return non-retryable client version errors and correct provider error types.
Keep safe user messages separate from operational diagnostics.
Unify error wording and document the conventions in the development skill.
Co-authored-by: Codex <noreply@openai.com>
Use passive upstream heartbeats and independent downstream liveness checks.
Reclaim unbound sockets after five idle minutes and release client-owned
resources on disconnect, with safe continuation ownership transfer.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): support configurable error protection rules
Replace capacity-specific freezing with bounded, configurable account error rules and shared attempt feedback.
Drop legacy settings without conversion and expose rule editing and freeze reasons in the admin UI.
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): preserve error protection scheduling boundaries
Keep xAI accounts excluded while recovery probes are pending, and cover
selection before and after recovery.
Separate scheduling cooldown reads from admin display details, share the
atomic Redis migration and selection logic, and use one policy revision.
Remove the unused adaptive concurrency reduction path and its tests.
Validation: 393 targeted backend tests, workspace Clippy with -D warnings,
Rustfmt, frontend type checking and build, and local service health checks.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Recognize official TUI, exec, IDE, SDK and App Server/MCP product names using the Core version in the User-Agent. Keep Desktop app version handling and unknown-client compatibility intact.
Compare SemVer precedence without build metadata, cover HTTP/SSE and real WebSocket admission, and align API documentation and localized settings help.
Validated 54 targeted and architecture tests, strict Clippy, Rust formatting, frontend lint/build, and localized component previews.
Co-authored-by: Codex <noreply@openai.com>
* feat(usage): add request concurrency trends
* perf(usage)!: unify load insights and optimize concurrency
Aggregate concurrency on a single event timeline and reuse lifecycle
indexes instead of joining every request against every time bucket.
Align load summaries and trend points with the four chart metrics,
combine concurrency and scheduling in one view, and right-align the
statistics card selectors. Update the API contract and regression tests.
BREAKING CHANGE: Usage insights concurrency and scheduling P95 fields
move under performance.load and performance.points[].load. Unused
scheduling P50, capacity, and performance coverage fields are removed.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Centralize account authentication, plan and model eligibility for Images and Live. Reuse the same checks before leases, affinity and retries, while preserving unknown plans and Free text/search access.
Co-authored-by: Codex <noreply@openai.com>
Resolve reasoning effort from configuration updates and preserve overrides in response-scoped session metadata without rewriting upstream requests. Cover HTTP and WebSocket continuations, new-chain resets, and baseline changes.
Co-authored-by: Codex <noreply@openai.com>
Match account names and emails, client key names and labels, and observability search fields by literal substrings. Preserve wildcard escaping and existing case rules.
Co-authored-by: Codex <noreply@openai.com>
* feat(plugin): publish account-scoped adapted model catalogs
* fix(core): preserve candidate account scope during execution
Apply the narrowed candidate scope before provider account selection, including affinity and account rotation. Cover adapted-only models and same-name models with incompatible tool capabilities through the real OpenAI selector and local HTTP fixtures.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep incompatible plugins out of execution sets during automatic startup.
Require scoped confirmation for manual compatibility overrides and show
the stopped state and upgrade effects in the management UI.
Co-authored-by: Codex <noreply@openai.com>
Accept optional deployment strings for residency and account routing,
discard downstream values when unset, and isolate WebSocket connections
by the configured handshake headers.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Remove upstream response model tracking across providers, storage, APIs,
and plugin facts without migrating historical records.
Refine sidebar hints, locale loading indicators, model columns, and usage
page labels and filters.
Co-authored-by: Codex <noreply@openai.com>
Use request, attempt, and outbound middleware for plugin-owned identity
selection and complete request rewriting. Preserve native account identity
and partition WebSocket connections through existing outbound opening changes.
Remove the construction parameter channel and its obsolete tests and docs.
Keep middleware at v6 without a compatibility shim.
Co-authored-by: Codex <noreply@openai.com>
Track pending charges in memory and settle them with a supervised worker.
Include pending costs in budget checks without retrying historical writes
at admission, and reject new admissions when the backlog reaches its limit.
Use idempotent per-key batches with write deadlines, adaptive batch sizes,
and bounded shutdown draining. Keep load tests outside the regular suite.
Co-authored-by: Codex <noreply@openai.com>
Group identical positive samples before numeric logarithm evaluation while retaining histogram boundaries and weights. Remove nine unused trend fields and synchronize frontend types, preview data, and API documentation.
Validate against the 30-million-row Docker dataset, matching retained statistics and reducing uncached today-summary median latency from 623 ms to 319 ms. Run 133 related tests, Clippy, formatting, frontend checks, and browser tab checks.
Keep dashboard and quota relative-time thresholds and future timestamps owned by the backend deployment timezone. Localize only the structured presentation in the frontend.
Co-authored-by: Codex <noreply@openai.com>
Move account metric and relative-time presentation to the frontend using raw API values. Tighten latency unit spacing and unify edit actions and page header sizing.
Co-authored-by: Codex <noreply@openai.com>
Restore quota labels, custom window durations, account usage panel width,
and consistent USD symbols. Return stable provider identity attribute keys
for frontend localization and refine login controls, copy, and alignment.
Pin hyper-util to the 0.1.21 registry release and remove the Git patch.
Tests were not rerun for this combined commit, as requested.
Co-authored-by: Codex <noreply@openai.com>
Preserve turn IDs and parent references across request metadata, input history, headers, Images and Desktop context. Update contract coverage and API documentation for unchanged turn identity across accounts.
Co-authored-by: Codex <noreply@openai.com>
Forward Live business headers through shared identity and transport filters,
preserving HTTP header bytes and repeated values. Scope tracking identifiers
to the selected or pinned account, remove client tracing and account-bound
metadata, and retain Live call ownership.
Preserve x-session-id and voice-session-id as business session references,
consistent with Codex 0.164.0. Validate standard HTTP header names in Core
and document the distinction between tracking and business identifiers.
Validation: 36 targeted nextest checks passed. Real-account checks through
the production Provider and LiveGateway completed SDP creation (201), WebRTC
connection and session.started, sideband events, and hangup (200), including
header-only business identifiers. Bidirectional RTP traffic was observed.
The deployed HTTP/UI path and speech recognition or spoken replies were not
validated; the earlier Voice session access denied error was not reproduced.
Co-authored-by: Codex <noreply@openai.com>
Keep client context dates stable across midnight, continuation and replay
while retaining timezone and web search location overrides. Remove wall-clock
dependence from both request encoding and selected-account adaptation.
Cover appended day contexts, replay, and HTTP/WebSocket upstream payloads;
update the request-location contract. The regression fails before the fix.
Provider tests (1028), architecture checks (14), workspace strict Clippy,
Rustfmt and diff checks pass.
Refs #503; the reported repeated zero-cache requests are not yet confirmed
to share this cause.
Co-authored-by: Codex <noreply@openai.com>
* feat(frontend): add English and Traditional Chinese locales
* fix(frontend): capitalize the English login key label
* fix(frontend): capitalize standalone English labels
* feat(frontend): add reactive localization and refine admin layouts
Replace DOM text translation with domain-based Vue I18n resources for English, Simplified Chinese, and Traditional Chinese. Localize shared controls, notifications, charts, and key usage while refining table alignment, menus, and compact labels.
Expose semantic usage-window and trend-metric identifiers from the API. Pin the UI and workbench dependencies to published feature commits and preserve the original font defaults.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Jimbb <14995924+jimbb@users.noreply.github.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve request evidence and cold middleware boundaries across cancellation. Make backup auditing atomic, retain committed account-group results, and serialize restart operations.
Unify frontend stream authentication and session recovery, clear stale secrets, and remove redundant runtime paths. Correct CI permissions and database test URL handling.
Align documentation with current module responsibilities, APIs, and validation workflows, including both submodules.
Map input turn references with the same account identity as request metadata.
Limit the workspace preset to metadata usernames and remote namespaces;
preserve project names and executable paths to avoid path failures and
same-parent workspace collisions.
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): honor configured request body limits
* test(plugin-sdk): mirror upstream adapter module layout
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): preserve frozen request body budgets across callbacks
Carry the execution body budget through policy and attempt callbacks, and validate explicit-key model requests against their bound snapshot. Add regression coverage for configuration publication and document budget ownership and lifetime.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Expose the stored proxy ID through account queries and use it to display
the bound proxy name without matching redacted endpoints. Preserve
unchanged bindings and keep the preserve option for batch editing.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Export business data and published hourly usage from a shared snapshot as
bounded gzip SQL archives, excluding request history and diagnostic data.
Run bounded retention cycles every minute, deleting oldest unlocked rows
with per-batch lock and statement deadlines.
Add real PostgreSQL export/restore and lock-contention coverage, document
the backup scope, and move detailed UI guidance into a help popover.
Validation: 4011 backend tests passed in partitions; Rustfmt, Clippy,
frontend lint/type checks, and actionlint passed. Resource-limited load
checks covered current-adapter million-row backups and a read-only policy
check on the existing 31-million-row database. Final popover interaction
checks were stopped at the user's request. Online restore is deferred.
Co-authored-by: Codex <noreply@openai.com>
Record first-token timing from nonempty HTTP SSE data or WebSocket messages before JSON and event classification. Preserve semantic output, reasoning and text timing boundaries.
Co-authored-by: Codex <noreply@openai.com>
Preserve response.create field order and align OAuth query ordering with
current official Codex sources.
Stop adding the timing-metrics request header by default and remove the
four unused engine TTFT and token interval fields throughout the backend,
plugin observation contracts, and frontend. Keep rate calculations unchanged.
Co-authored-by: Codex <noreply@openai.com>
Share data columns and status filters between admin and key usage. Keep final error summaries in the error view and focus error details in a separate dialog.
Use logical request outcomes for key usage records and keep concurrency lists at a stable height without pagination.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
蓝芷怡andCodex
ZyyandCodex
