Discover models per account so the Codex picker includes models unique to an eligible group member. Use account-specific catalog evidence when selecting a credential for native Responses requests.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Support Responses, Chat Completions and Messages ingress with Responses
or Messages API upstreams in the existing OpenAI provider.
Share generation admission and delivery, preserve native protocol payloads,
and translate cross-protocol tools, reasoning, streams and usage. Add
Messages token counting and editable upstream protocol settings.
Co-authored-by: Codex <noreply@openai.com>
* feat(keys): add explicit budget windows with safe retries
Add revision-checked daily and weekly windows across admission, settlement
and queries. Reuse the existing budget ledger for atomic window updates,
latest-operation replay and audit records.
Expose typed SDK callbacks while keeping account associations and cycle
decisions in plugins.
Refs #658
Co-authored-by: Codex <noreply@openai.com>
* fix(keys): preserve budget accounting across window changes
Keep restored balances when historical charges are unavailable and reject window changes that would require those charges. Honor future start times after release and report actual spending windows to peers.
Require an explicit null to release a window through the plugin SDK.
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): preserve budget window precision across SDK calls
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Supervise scheduling lease release tasks and drain them within a bounded shutdown budget. Preserve other instances and the existing TTL fallback.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Read update candidates from the published channel table and advance it only after the release assets are public. Keep the tagged preparation commit separate from the publication commit.
Co-authored-by: Codex <noreply@openai.com>
* fix(admin): preserve proxy capacity in OAuth pending state
Persist the saved proxy's WebSocket capacity in the shared pending
authorization codec and restore it before the Store checks the snapshot.
Keep genuine proxy changes and disabled proxies rejected.
Co-authored-by: Codex <noreply@openai.com>
* docs(deploy): clarify OAuth proxy upgrade guidance
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Publish an immutable channel snapshot with each release and advance a fixed release pointer only after public assets pass verification. Check the exact platform package before notifying clients.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): test account egress and assign accounts in bulk
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): refine proxy controls and quota display
Keep egress results with their proxy options and refresh stale proxy revisions before retrying. Compact account assignment and settings controls, and hide missing quota refresh timestamps.
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): reset account selection without closing dialog
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): clarify assignment reset and unavailable accounts
Use a red reset button and disabled checkboxes for accounts already using the target proxy.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): show account details in assignment dialog
Add platform, subscription, and group columns, remove inline provider icons, and use the existing subtle danger style for reset.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Clear the peer badge when the upstream explicitly disables sharing or does not support CPR Link. Preserve identity on transient failures and allow manual rediscovery from the quota panel.
Co-authored-by: Codex <noreply@openai.com>
Expose /readyz for the runtime snapshot, PostgreSQL, and Redis. Keep worker and logging diagnostics on /healthz so a maintenance failure can alert without removing a serving instance from service discovery.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use a fresh upstream key concurrency limit as the account default for scheduling, leases, and capacity reporting. Show disclosed limits alongside the upstream pool summary.
BREAKING CHANGE: Both peers must support CPR Link schema v3.
Refs: #587
Co-authored-by: Codex <noreply@openai.com>
Build x64 and ARM64 release archives with a static MSVC runtime.
Support executable replacement, restart handoff and rollback on Windows.
Co-authored-by: Codex <noreply@openai.com>
Make capability blocks optional and represent key budgets as named windows. Centralize validation and preserve unknown states for missing observations.
BREAKING CHANGE: CPR Link requires schema_version 2; v1 snapshots are no longer accepted.
Co-authored-by: Codex <noreply@openai.com>
Export authoritative budget access flags and keep monetary fields display-only
for peer consumers. Use the official usage_limit_reached error type for budget
exhaustion while preserving ordinary rate-limit cooldowns.
Apply fresh quota facts atomically with peer snapshots through the shared quota
writer, retaining connection, claim, and observation-time guards. Reuse the
existing sync worker and document the recovery contract.
Validated with 234 selected tests, strict workspace Clippy, and Rustfmt.
Co-authored-by: Codex <noreply@openai.com>
* feat(peer): add automatic discovery and scalable quota sharing
Export authorized direct-account pools and budgets through the CPR peer
protocol, with durable upstream discovery and immutable scheduling views.
Show shared-pool node quotas through common quota popovers and lazy account
details. Bound snapshot reads and export concurrency, reduce Redis and SQL
work, and keep only the latest observation for each upstream connection.
Co-authored-by: Codex <noreply@openai.com>
* refactor(peer): centralize upstream discovery and quota projections
Move peer synchronization into Admin, HTTP transport into Host, and expose
neutral Core scheduling signals through explicitly wired provider capabilities.
Preserve provider-visible model catalogs and independent quota disclosure,
with stale windows following the existing OAuth quota layout.
Cover cross-provider discovery, lifecycle fencing, and database leases, and
update the architecture and usage documentation.
Co-authored-by: Codex <noreply@openai.com>
* fix(ui): center usage card loading and empty states
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): unify peer subscription badges across account views
Share CPR identity rendering through AccountPlanBadge, project upstream metadata into dashboard and proxy account views, and align quota empty states and API badges.
Co-authored-by: Codex <noreply@openai.com>
* fix(peer): bound snapshot work and preserve quota windows
Keep summary reads off full snapshots, reject oversized model expansion early, and yield export work. Preserve daily and weekly unlimited budgets, hide empty token counters, and unify quota empty states.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Send upstream Ping frames every 25 seconds without a Pong deadline.
Keep downstream cancellation, business idle timeout and pool eviction
independent from heartbeat traffic, with bounded heartbeat writes.
Co-authored-by: Codex <noreply@openai.com>
Track inbound byte progress before WebSocket decoding so active uploads do not trip the heartbeat timeout. Reuse Axum handshake validation and report actual receive idle time.
Cover successive slow uploads and stalled partial frames, and document the downstream liveness contract.
Validation: 652 API and gateway tests passed; production API check, strict workspace Clippy, and formatting passed.
Co-authored-by: Codex <noreply@openai.com>
Return non-retryable client version errors and correct provider error types.
Keep safe user messages separate from operational diagnostics.
Unify error wording and document the conventions in the development skill.
Co-authored-by: Codex <noreply@openai.com>
Use passive upstream heartbeats and independent downstream liveness checks.
Reclaim unbound sockets after five idle minutes and release client-owned
resources on disconnect, with safe continuation ownership transfer.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): support configurable error protection rules
Replace capacity-specific freezing with bounded, configurable account error rules and shared attempt feedback.
Drop legacy settings without conversion and expose rule editing and freeze reasons in the admin UI.
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): preserve error protection scheduling boundaries
Keep xAI accounts excluded while recovery probes are pending, and cover
selection before and after recovery.
Separate scheduling cooldown reads from admin display details, share the
atomic Redis migration and selection logic, and use one policy revision.
Remove the unused adaptive concurrency reduction path and its tests.
Validation: 393 targeted backend tests, workspace Clippy with -D warnings,
Rustfmt, frontend type checking and build, and local service health checks.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Include the realtime WebSocket base URL in generated Codex configuration and document voice setup. Simplify configuration comments.
Track key reveal actions separately so opening client configuration and copying a key show loading only on the initiating button. Preserve duplicate request protection and stale request cancellation.
Co-authored-by: Codex <noreply@openai.com>
Keep incompatible plugins out of execution sets during automatic startup.
Require scoped confirmation for manual compatibility overrides and show
the stopped state and upgrade effects in the management UI.
Co-authored-by: Codex <noreply@openai.com>
Accept optional deployment strings for residency and account routing,
discard downstream values when unset, and isolate WebSocket connections
by the configured handshake headers.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep client context dates stable across midnight, continuation and replay
while retaining timezone and web search location overrides. Remove wall-clock
dependence from both request encoding and selected-account adaptation.
Cover appended day contexts, replay, and HTTP/WebSocket upstream payloads;
update the request-location contract. The regression fails before the fix.
Provider tests (1028), architecture checks (14), workspace strict Clippy,
Rustfmt and diff checks pass.
Refs #503; the reported repeated zero-cache requests are not yet confirmed
to share this cause.
Co-authored-by: Codex <noreply@openai.com>
Preserve request evidence and cold middleware boundaries across cancellation. Make backup auditing atomic, retain committed account-group results, and serialize restart operations.
Unify frontend stream authentication and session recovery, clear stale secrets, and remove redundant runtime paths. Correct CI permissions and database test URL handling.
Align documentation with current module responsibilities, APIs, and validation workflows, including both submodules.
ZyyandCodex
ZyyandZyy
dependabot[bot]
