Read response-scoped engine and API overhead metrics while excluding logical-turn totals and incomplete observations. Validate nested response IDs and cover the observed payload over SSE and WebSocket.
Co-authored-by: Codex <noreply@openai.com>
Extend the startup healthcheck grace period to five minutes and report elapsed migration time every fifteen seconds without changing published migrations.
Use one shutdown path for OS signals, internal cancellation, and managed restarts. Stop listening without waiting for active sessions, preserve bounded worker cleanup, and remove the obsolete connection drain timeout.
Cover shutdown entry points and worker cleanup with real HTTP lifecycle tests and document the deployment behavior.
Co-authored-by: Codex <noreply@openai.com>
Share unchanged prepared instances across extension sets and close each
process when its last owner releases it. Keep inflight request plans intact.
Unify migration recovery and publication, centralize authentication binding
validation, avoid duplicate package inspection, and separate middleware plans.
Validated with 292 admin, 182 runtime, 37 plugin storage and 15 architecture
tests, rustfmt, and strict workspace Clippy.
Co-authored-by: Codex <noreply@openai.com>
Remove version migration narratives, consolidate repeated explanations, and organize settings and architecture references.
Co-authored-by: Codex <noreply@openai.com>
Load account and API key group selectors through a lightweight admin options
endpoint while preserving pagination, filters, disabled groups and revision
metadata. Keep aggregate statistics on the group management endpoint.
Co-authored-by: Codex <noreply@openai.com>
Consolidate request diagnostics into typed request_observation_json with
migration 0025, preserving historical facts and query constraints.
Use upstream response timestamps for output throughput, align TTFT event
boundaries, and surface official timing metrics in the latency popover.
Co-authored-by: Codex <noreply@openai.com>
Give Guardian requests a separate per-account lease pool and wait queue while preserving ordinary concurrency and shared request intervals. Use the ordinary pool when the Guardian limit is zero, and align scheduling, diagnostics, settings copy, and documentation.
Co-authored-by: Codex <noreply@openai.com>
Check the recorded native continuation scope before selecting an account
or committing a session binding. Reuse the same scope validation after
middleware while preserving native connection checks and migration policy.
Cover ReplayOwner and ReplayAny with persisted provider metadata or a
connection-local pin, with and without an existing session binding.
Rejected replays must not acquire leases, write bindings or aliases, send
upstream requests, or redirect subsequent child requests.
Refs #364
Co-authored-by: Codex <noreply@openai.com>
Allow requests with a reliable session identity to claim a missing account
binding, including child threads and independent background tasks. Remove
the missing-binding wait queue while preserving existing migration rights
and bound-account waiting behavior.
Cover concurrent root/child claims, memory prewarm and turn reuse,
middleware identity changes, cancellation, and bound-account timeouts.
Update the documented strict-affinity contract.
Co-authored-by: Codex <noreply@openai.com>
Separate execution, provider ports, administration, and plugin lifecycle responsibilities.
Fix shutdown ordering, account lock reclamation, multipart cancellation, budget windows, and WebSocket close handling.
Align xAI catalog, reasoning, tools, replay, quota, and cost handling with current Grok contracts and remove legacy fallbacks.
Update API and architecture documentation with regression coverage. Validated backend suites, strict workspace Clippy, isolated PostgreSQL/Redis integration, and real Codex/Grok client flows.
Co-authored-by: Codex <noreply@openai.com>
Count non-preamble Responses events for first-token timing while preserving
semantic output boundaries and request-level timing origins. Calculate
output throughput over the complete request duration in usage rows and
aggregate queries.
Co-authored-by: Codex <noreply@openai.com>
Route relaxed requests through the configured scheduler and keep the session primary during preferred-mode spillover. Default new settings to strict while preserving saved modes.
Co-authored-by: Codex <noreply@openai.com>
Use read-only status checks for initial authentication and remove activity-driven renewal. Keep failed and newly queued requests waiting for the current refresh before replaying with the updated cookie.
Co-authored-by: Codex <noreply@openai.com>
Reuse domain models for observability, account statistics, execution facts,
and group validation. Compose shared settings values while preserving
HTTP and SDK contracts and explicit storage and runtime boundaries.
Verify serialization, concurrency, persistence, and snapshot behavior with
3528 backend tests, strict Clippy, formatting, and architecture checks.
Co-authored-by: Codex <noreply@openai.com>
Add relaxed and strict affinity modes, configurable binding retention, and per-request account rotation limits. Freeze policies for each request and preserve continuation ownership and plugin selection behavior.
Expose the controls in a dedicated affinity settings card and cover scheduling, persistence, renewal, and retry boundaries.
Co-authored-by: Codex <noreply@openai.com>
Preserve native failure causes through store, provider, plugin, admin, and
worker boundaries, including secondary cleanup failures. Route operational
failures through the shared diagnostics sink with protected error details.
Use bounded nonblocking file logging with batched writes and reserved
warning/error capacity. Reserve observation capacity for failures and
request lifecycle records, and rate-limit overload warnings.
Validate error propagation and blocked-output HTTP, admin, SSE, and WebSocket
behavior; keep the local migration plan out of version control.
Co-authored-by: Codex <noreply@openai.com>
Retain preparation and account-selection diagnostics, preserve plugin fault
details, and record failures before attempt startup. Keep failure
classification when trace summaries are truncated.
Carry native error sources through Core, infrastructure availability errors,
OpenAI credential selection, provider inference, and plugin upstream adapters.
Preserve original upstream codes independently of failure classification and
project bounded cause chains and upstream bodies into protected error details.
Rename persisted and admin API error detail fields, keep raw details out of
ordinary logs and diagnostic exports, and account for retained error data in
the observation queue memory budget. Add regression coverage for source
retention, safe output, and migration upgrades; remove account-dependent live
tests. Document the implemented diagnostic boundaries.
Refs #357
Co-authored-by: Codex <noreply@openai.com>
Record semantic output from the first stream chunk and reuse Core timing for xAI. Add regression and opt-in live transport coverage.
Co-authored-by: Codex <noreply@openai.com>
Renew active administrator sessions with atomic Redis expiry updates,
synchronized cookies, and idle and absolute lifetime limits. Preserve
revocation after logout and password changes.
Coordinate session recovery, bounded retries, error handling, and raw
responses through request plugins. Gate initial navigation in the router
and organize frontend API modules by their views.
Co-authored-by: Codex <noreply@openai.com>
Share the current account across root and descendant requests, including
Search, Images turn aliases, and Live creation. Keep root recovery and
explicit plugin scheduling intact while descendant requests wait for the
current owner and follow root migrations.
Use versioned admission before sending so concurrent claims and late
responses cannot overwrite newer bindings. Cover queue lifecycle,
continuation recovery, endpoint routing, and Redis concurrency behavior.
Co-authored-by: Codex <noreply@openai.com>
Freeze the selected client profile for Live sideband, reconnect and hangup,
while reloading current account credentials and outbound proxy settings.
Share identity-header protection, clear turn state across wire entry points,
and include Guardian and residency headers in WebSocket connection matching.
Normalize the existing Cargo.lock http reference without changing versions.
Validated 1389 tests, workspace strict Clippy, Rustfmt and architecture checks.
Co-authored-by: Codex <noreply@openai.com>
Stagger credential refresh and quota observations, bound each request to three account rotations, and expose terminal and version lag configuration.
Retain main's bounded refresh 401 recovery policy. Version lag accepts integers from 1 to 10 or an empty value.
Co-authored-by: Codex <noreply@openai.com>
Add scoped call bootstrap, pinned-account sideband relay and hangup. Preserve model metadata, use standard WebSocket handshakes, and release session claims safely on cancellation.
Validated with regression tests, CI and a real OAuth/WebRTC call.
Co-authored-by: Codex <noreply@openai.com>
Allow long model responses to finish without a fixed 600-second deadline,
while preserving explicit plugin deadlines and upstream idle timeouts.
Renew request recovery, client admission and provider scheduling leases
for the session lifetime, and release their renewal tasks with the owners.
Keep observation renewal best-effort and cancel on lost concurrency leases.
Fixes#342
Co-authored-by: Codex <noreply@openai.com>
Configure Guardian reservations through persisted runtime settings and frozen request policies. Combine concurrency controls and queues in the admin UI, with the scheduling strategy shown first.
Prioritize Guardian account waiters, recheck displaced queue heads before lease acquisition, and report request-specific available capacity. Preserve account, key and wait-budget limits.
Co-authored-by: Yongzhao Chen <yongzhao.derek@gmail.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Co-authored-by: Codex <noreply@openai.com>
Use one validated IANA timezone for backend display projections, calendar queries, budget windows, warmup slots, backups, and logs. Remove frontend date formatting and the independent backup timezone setting.
Preserve UTC instants and active budget windows, persist warmup deduplication, and advance backup schedules transactionally. Cover DST boundaries, timezone changes, invalid calendar anchors, and account cooldown displays.
Co-authored-by: Codex <noreply@openai.com>
Expose upstream credit facts through the account quota API while preserving
decimal balances and distinguishing zero, unlimited, and missing values.
Clear stale balances on passive updates without changing quota availability.
Display credits below reset cards, label OpenAI quota as Codex quota, and
standardize the account quota action icons.
Co-authored-by: Codex <noreply@openai.com>
Restore the pre-window host implementation and document plugin-owned policy and presentation. Keep native reset RPC coverage and run plugin integration tests with the standard isolated test services.
Co-authored-by: Codex <noreply@openai.com>
Move the quota forecast entry after reset credits and propagate account updates from the quota panel. Include each error account current subscription in troubleshooting and unify subscription labels.
Co-authored-by: Codex <noreply@openai.com>
Use all matching requests for diagnostic shares and count retried requests once. Show current account plans in diagnostics and request records with compact, aligned columns.
Simplify quota forecasts and remove unused remaining-capacity response fields. Open system updates immediately with the existing loading skeleton and clip masked key prefixes without an ellipsis.
Co-authored-by: Codex <noreply@openai.com>
Compose HTTP, WebSocket, request, attempt and public service calls through
shared onion middleware with scoped settings and invocation context.
Adopt trusted-process manifests, unified observation and forward-compatible
SDK contracts. Align management UI, documentation and the workbench reference.
Preserve native response bytes and WebSocket failure lifecycles.
Co-authored-by: Codex <noreply@openai.com>
Reuse immutable plugin archives across nextest processes and share admin fixtures within test matrices. Reduce log scanning, hashing, compression, database setup, and SSE scanning costs while preserving isolation and boundary coverage.
Use controllable clocks for recovery budgets and quota scheduling, retaining real socket and HTTP verification.
Validation: 3200 backend tests, 132 plugin persistence tests, 54 Redis ACL tests, 30 clock stress iterations, clippy, and formatting checks passed. Local full-suite runtime improved from 182.8s to 74.0s at unchanged concurrency.
Co-authored-by: Codex <noreply@openai.com>
Keep documentation focused on current behavior and clear ownership.
Load skill references by task and clarify official source priority and reply tone.
Co-authored-by: Codex <noreply@openai.com>
Filter account-owned routing and identity context at API and Provider boundaries. Bind WebSocket interrupts to the active response on its original account and socket, preserving valid continuations.
Co-authored-by: Codex <noreply@openai.com>
Make smart scheduling coefficients configurable and expose optional
higher-weight switchback while preserving the original defaults.
Reuse current quota reset signals, process-local queues, and frozen request
settings while preserving continuation ownership and queue fairness.
Co-authored-by: Codex <noreply@openai.com>
Reuse secure UUID generation for plugin frame channels and sessions on HTTP.
Consolidate utility modules and shorten the plugin views store name.
Declare route roles and default entries in metadata instead of guard mappings.
Keep source integration build output under node_modules/.vite.
Validated frontend lint, production and source builds, browser plugin flows,
and 20 route guard scenarios with simulated sessions and plugin resources.
Fixes#288
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
think-backandCodex
KumikoLoveandCodex
2han9wen71anandCodex
CharmskyandCodex