Use the configured affinity mode for content and cache-key bindings, including strict waiting and binding store failures. Cover queue rejection, cancellation, migration, and preferred spillover, and document the scheduling boundaries.
Refs #623
Co-authored-by: Codex <noreply@openai.com>
Use the client cache key or the opening messages as a tenant-scoped scheduling preference. Keep explicit sessions and continuation ownership separate, and allow spillover when the preferred account is busy.
Refs #622
Co-authored-by: Codex <noreply@openai.com>
Let OpenAI accounts send explicitly allowlisted model IDs upstream while retaining catalog checks for other accounts. Update the account editor and connection test to support custom IDs.
Co-authored-by: Codex <noreply@openai.com>
Count incomplete requests as errors, exclude recovered and cancelled requests from success rates, and preserve gaps for missing samples.
Co-authored-by: Codex <noreply@openai.com>
Distinguish connection failures from uncertain authorization results and retain redacted diagnostic causes. Increase token connection timeout to 30 seconds and total request timeout to 60 seconds.
Co-authored-by: Codex <noreply@openai.com>
Notify idle clients with Close 1000 after upstream loss while preserving settlement and queued requests. Align idle transport termination detection with Codex and document the reconnect contract.
Co-authored-by: Codex <noreply@openai.com>
Preserve client-supplied turn state on full requests with unknown ownership
and remove the process-local proof cache. Keep confirmed account-switch
cleanup and existing continuation authorization boundaries.
Cover HTTP and WebSocket retries, provider recreation, expired affinity,
and conflicting account ownership; update the API and architecture docs.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): test account egress and assign accounts in bulk
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): refine proxy controls and quota display
Keep egress results with their proxy options and refresh stale proxy revisions before retrying. Compact account assignment and settings controls, and hide missing quota refresh timestamps.
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): reset account selection without closing dialog
Co-authored-by: Codex <noreply@openai.com>
* fix(proxies): clarify assignment reset and unavailable accounts
Use a red reset button and disabled checkboxes for accounts already using the target proxy.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): show account details in assignment dialog
Add platform, subscription, and group columns, remove inline provider icons, and use the existing subtle danger style for reset.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Clear the peer badge when the upstream explicitly disables sharing or does not support CPR Link. Preserve identity on transient failures and allow manual rediscovery from the quota panel.
Co-authored-by: Codex <noreply@openai.com>
Map tool-result names, inline PDF inputs, and hosted web search to Responses. Project URL citations into Chat messages and preserve the requested output token limit in the OpenAI encoder.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Expose /readyz for the runtime snapshot, PostgreSQL, and Redis. Keep worker and logging diagnostics on /healthz so a maintenance failure can alert without removing a serving instance from service discovery.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use a fresh upstream key concurrency limit as the account default for scheduling, leases, and capacity reporting. Show disclosed limits alongside the upstream pool summary.
BREAKING CHANGE: Both peers must support CPR Link schema v3.
Refs: #587
Co-authored-by: Codex <noreply@openai.com>
Preserve account profiles and quota observations during OAuth refresh and retry deferral. Project rolling daily usage independently of upstream snapshots and expose its period through the existing account usage API.
Keep quota capacity forecasts scoped to weekly and monthly windows. Cover refresh persistence, daily statistics, API projection, and PostgreSQL CAS behavior.
Co-authored-by: Codex <noreply@openai.com>
Keep oversized Codex threads on SSE until a full request falls below 13.5 MiB. After delivering a response that requires full replay, close an idle Codex socket so the next step can send its history directly.
Co-authored-by: Codex <noreply@openai.com>
Keep undiscovered upstreams displayed as ordinary API keys and retain known peer errors without revoked shared data. Reuse quota refresh for retries and reset recognition when the connection changes.
Co-authored-by: Codex <noreply@openai.com>
Track bounded ownership proofs for upstream turn-state tokens, including failed responses, so same-turn full requests can echo them without trusting unrelated account state.
Co-authored-by: Codex <noreply@openai.com>
Use current peer summaries for request records and account diagnostics without changing historical snapshots or database schema.
Co-authored-by: Codex <noreply@openai.com>
Track hosted search initialization on pooled Codex sockets and retire incompatible connections before sending. Preserve existing client full replay recovery for connection-local deltas.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Reuse account plan resolution when exporting peer pool summaries. Read saved quota observations for missing plans even when quota sharing is disabled, without exposing quota data or mutating account records.
Cover unknown and missing plans, subtype preservation, plan-only limits, and quota refresh from an unknown account plan.
Co-authored-by: Codex <noreply@openai.com>
Require the official model_not_found code and supported status codes for
account-model cooldowns. Treat unsupported_value as a terminal request
error and preserve account eligibility across HTTP, SSE, and WebSocket.
Co-authored-by: Codex <noreply@openai.com>
Apply valid catalog membership alongside account model access for native OAuth, API key upstreams, and xAI. Preserve upstream validation for missing catalogs and unknown plans.
Co-authored-by: Codex <noreply@openai.com>
Filter known OAuth models by fresh plan catalogs and retain account-scoped model rejections. Preserve credential, transport, adapter, and continuation boundaries, and combine cooldown expiry without dropping protection semantics.
Co-authored-by: Codex <noreply@openai.com>
Persist unsupported CPR Link detection for each connection and skip periodic
probes across restarts. Retain manual rediscovery, connection invalidation,
retry throttling, and existing quota access protections.
Log stale response-cookie revision conflicts at debug while retaining
warnings for actual storage failures.
Validation: 29 peer-related tests, 14 cookie tests, 16 architecture checks,
strict Clippy, Rustfmt, and diff checks passed.
Co-authored-by: Codex <noreply@openai.com>
Make capability blocks optional and represent key budgets as named windows. Centralize validation and preserve unknown states for missing observations.
BREAKING CHANGE: CPR Link requires schema_version 2; v1 snapshots are no longer accepted.
Co-authored-by: Codex <noreply@openai.com>
Remove tracing headers and their WebSocket metadata copies through the existing correlation cleanup. Cover cache identity stability and WebSocket reuse after privacy header changes.
Co-authored-by: Codex <noreply@openai.com>
Share a four-request limit across CPR discovery, manual refreshes, and
periodic refreshes, and avoid loading runtime settings for initial reads.
Reuse account name and notes fields for import and editing, apply custom
names only to single-account imports, and match API usage bars to quota
progress styling.
Co-authored-by: Codex <noreply@openai.com>
Allow local account names to be changed or cleared without replacing credentials or account settings. Show the name with notes and fall back to email when the name is empty.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Store peer snapshots in existing account quota fields and remove dedicated node and synchronization tables. Keep CPR protocol handling in Admin and native quota handling in Providers, sharing persistence and the quota refresh endpoint.
Use runtime refresh coordination and preserve credential, connection, and observation-time guards. Update the unreleased migration, API contracts, documentation, and regression coverage.
Validated with 354 selected tests, strict workspace Clippy, Rustfmt, frontend lint and build, and migration checksum verification. Browser interaction remains unverified.
Co-authored-by: Codex <noreply@openai.com>
Export authoritative budget access flags and keep monetary fields display-only
for peer consumers. Use the official usage_limit_reached error type for budget
exhaustion while preserving ordinary rate-limit cooldowns.
Apply fresh quota facts atomically with peer snapshots through the shared quota
writer, retaining connection, claim, and observation-time guards. Reuse the
existing sync worker and document the recovery contract.
Validated with 234 selected tests, strict workspace Clippy, and Rustfmt.
Co-authored-by: Codex <noreply@openai.com>
* feat(peer): add automatic discovery and scalable quota sharing
Export authorized direct-account pools and budgets through the CPR peer
protocol, with durable upstream discovery and immutable scheduling views.
Show shared-pool node quotas through common quota popovers and lazy account
details. Bound snapshot reads and export concurrency, reduce Redis and SQL
work, and keep only the latest observation for each upstream connection.
Co-authored-by: Codex <noreply@openai.com>
* refactor(peer): centralize upstream discovery and quota projections
Move peer synchronization into Admin, HTTP transport into Host, and expose
neutral Core scheduling signals through explicitly wired provider capabilities.
Preserve provider-visible model catalogs and independent quota disclosure,
with stale windows following the existing OAuth quota layout.
Cover cross-provider discovery, lifecycle fencing, and database leases, and
update the architecture and usage documentation.
Co-authored-by: Codex <noreply@openai.com>
* fix(ui): center usage card loading and empty states
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): unify peer subscription badges across account views
Share CPR identity rendering through AccountPlanBadge, project upstream metadata into dashboard and proxy account views, and align quota empty states and API badges.
Co-authored-by: Codex <noreply@openai.com>
* fix(peer): bound snapshot work and preserve quota windows
Keep summary reads off full snapshots, reject oversized model expansion early, and yield export work. Preserve daily and weekly unlimited budgets, hide empty token counters, and unify quota empty states.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve authentication snapshots for diagnostic account badges and align
account note typography. Hide unavailable dashboard quotas consistently
and show available quota rates independently of local request counts.
Co-authored-by: Codex <noreply@openai.com>
ZyyandZyy
