Add model aliases, minimal read-only account and quota facts, bounded retry
policies and middleware capability declarations. Preserve unchanged payloads
and expose the new contracts in the SDK and plugin configuration UI.
Remove the ignored external observer example test.
Co-authored-by: Codex <noreply@openai.com>
Define the initial plugin manifest and wire protocol without legacy branches.
Preserve large request payloads and isolate local RPC encoding failures.
Co-authored-by: Codex <noreply@openai.com>
Align the visible skill name with plugin-dev and document published resources, host platform selection, configuration defaults, and release installation behavior.
Co-authored-by: Codex <noreply@openai.com>
Show release assets with filename tooltips, size tags, and a compact selection state. Remove duplicate release version labels.
Co-authored-by: Codex <noreply@openai.com>
Consolidate unreleased migrations, fix plugin startup and header projection, verify Grok boundaries, and update current documentation and plugin development guidance.
Co-authored-by: Codex <noreply@openai.com>
Integrate PR #276 on the current main baseline. Keep local connection
capacity failures out of upstream retry and WebSocket breaker accounting.
Keep existing settings assertions valid when the #192 migration adds columns.
Source-commit: f9828a588f
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep Grok request markers, header filtering, and exact instruction-prefix handling in the downstream adapter. Apply the body adaptation only after selecting a Codex OAuth account and only when an observed Grok marker is present. Preserve unmarked and API-key client fields.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Publish committed account and permission facts with the current model catalog while the extension set is unchanged. Preempt in-flight background catalog reconciliation for a new configuration commit; periodic reconciliation refreshes the catalog afterward. Confirm account saves before asynchronously reloading lists and groups.
Co-authored-by: Codex <noreply@openai.com>
Treat upstream WebSocket close 1009 as a request-scoped message-too-big error.
Return a structured HTTP 413 or WebSocket error without penalizing the account,
opening the provider circuit, or consuming the session WebSocket failure budget.
Keep the post-send state ambiguous so the gateway never replays the payload.
Cover repeated 1009 closes and the next successful WebSocket request.
(cherry picked from commit fb6ef1d080)
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Distinguish pump termination and stream EOF from actual upstream Close
frames without changing send-state or replay-safety classification.
Cover Pong timeout diagnostics on fresh and reused connections.
Refs #249
Co-authored-by: Codex <noreply@openai.com>
(cherry picked from commit 5a89bbc26b)
Use the account that served each completed request to attribute group costs.
Multi-group client keys no longer charge groups that did not serve the request.
Historical costs follow the account's current group membership.
(cherry picked from commit 6f16c8efd1)
Co-authored-by: Codex <noreply@openai.com>
Detect and persist proxy locations on enable, connection changes, and explicit
tests. Preserve manual locations and guard stale detection results. Allow a
successful outlet probe to fill the manual location fields on request.
Co-authored-by: Yanshan Chen <16632048+chenyanshan@users.noreply.github.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Integrate the three Dependabot updates to Cargo.lock.
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Introduce SDK 0.4, manifest v3, protocol v4, the isolated plugin runtime,
and cpr-plugin packaging CLI for independently maintained plugins.
Support installation, permissions, one active configuration per plugin,
version-specific settings, rollback, management pages, and CLI extensions.
Isolate plugin failures so native gateway startup and requests remain available.
Keep provider registration and UI choices fixed to built-in OpenAI and xAI.
Support nine extension capabilities with permission-scoped model and account
callbacks to the host.
Unify plugin settings and version management, support plugin icons,
and improve narrow layouts. Use the fixed GitHub UI dependency and pnpm 12
for standalone frontend and container builds. Reduce runtime test packaging
cost and align preparation modules with the repository layout.
Co-authored-by: Codex <noreply@openai.com>
Same-account requests preserved opaque x-codex-turn-metadata headers after
account scoping, allowing the downstream installation ID to overwrite the
rebuilt header. Apply the existing turn metadata scoping to each opaque
value before serialization, retaining repeated values and extension fields.
Verify HTTP and WebSocket header/body identity consistency for same-account
and cross-account requests, including mixed-case repeated metadata headers.
Match the Responses metadata and compatibility projections in
openai/codex@c6c09fe29f,
codex-rs/core/src/responses_metadata.rs, lines 324-409.
Refs #226
Co-authored-by: Codex <noreply@openai.com>
Treat x-codex-installation-id as a managed identity header so HTTP and
WebSocket requests cannot carry a downstream installation ID alongside
account-scoped client_metadata. Keep installation identity in the body,
matching Codex Core's Responses metadata and compatibility headers.
Reference: openai/codex@7498521d28,
codex-rs/core/src/responses_metadata.rs, lines 315-382.
Cover same-account and cross-account scoping through mock HTTP and
WebSocket upstreams, plus mixed-case and repeated opaque headers.
Fixes#226
Co-authored-by: Codex <noreply@openai.com>
Preserve versioned API key model metadata and terminal request state across clock rollback. Close reset credit dialogs after confirmed consumption and refresh account quota in place.
Fixes#217Fixes#216
Co-authored-by: Codex <noreply@openai.com>
Read account notes by internal account ID for usage lists and Dashboard recent
requests. Show nonempty notes as secondary text using the existing label style.
Cover same-email accounts, note changes and removal, deleted-account history,
and the admin API and client key visibility boundaries.
Refs #190
Co-authored-by: Codex <noreply@openai.com>
Enable scheduling without clearing observed quota, credential errors, or cooldowns for disabled accounts. Keep explicit recovery for enabled accounts and document both paths.
Co-authored-by: Codex <noreply@openai.com>
Preserve recorded cycle usage and estimate only remaining capacity from
recent samples. Restart cycle totals and sampling after quota resets,
including resets following an exhausted observation.
Clarify cycle totals and duration conversions in the quota modal and API
documentation, and prevent narrow layouts from overflowing.
Validated with the full backend suite using isolated PostgreSQL and Redis,
strict Clippy, Rustfmt, frontend lint and build, and browser checks.
Co-authored-by: Codex <noreply@openai.com>
Reuse the shared About dialog from a toolbar icon and expose version and commit identifiers through an authenticated key-only endpoint. Align the About and refresh button backgrounds with the configuration button in dark mode.
Validate the response field allowlist and session boundaries, and document the new endpoint.
Co-authored-by: Codex <noreply@openai.com>
Replace the inline long-context badge with a themed yellow detail trigger and retain the billing context in its title and accessible label.
Co-authored-by: Codex <noreply@openai.com>
Count only confirmed capacity rejections toward account cooldown, excluding
generic server failures and unrecognized upstream errors. Classify streamed
invalid_prompt failures as invalid requests, matching official Codex.
Cover HTTP and WebSocket failures around the cooldown threshold while
preserving retry boundaries, upstream error payloads, and Smart scoring.
Update the capacity cooldown contract in the API and architecture docs.
Validation: Rustfmt, strict workspace Clippy, and all backend suites with
isolated PostgreSQL 18 / Redis 8 (--test-threads=4).
Reference: openai/codex@7498521d28,
codex-rs/codex-api/src/sse/responses.rs.
Refs #177
Co-authored-by: Codex <noreply@openai.com>
Detach online updates from HTTP request lifetimes and recover their persisted status in the admin UI. Retain current release notes when no upgrade is available while preserving upgrade restrictions.
Fixes#185
Co-authored-by: Codex <noreply@openai.com>
The public Responses API accepts `input` as a plain string, but the Codex
backend only accepts an item list and rejects such requests with
400 "Input must be a list". Expand a string `input` into a single user
message item in the downstream body compatibility layer so that HTTP/SSE
and WebSocket share the same rule; arrays and other shapes pass through
untouched.
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
Return 429 usage_limit_reached when all eligible accounts have exhausted their quota. Preserve provider fallback, continuation recovery, and other unavailability causes.
Cover HTTP and WebSocket error contracts and account selection boundaries. Verified with 2516 backend integration tests, strict Clippy, and the official Codex CLI using gpt-5.6-luna and a quota-exhausted account.
Co-authored-by: Codex <noreply@openai.com>
Normalize explicit system messages to developer at the shared Codex request boundary while preserving message content and other fields. Cover HTTP and WebSocket request bodies and document the compatibility behavior.
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
jiahao6635andCodex
jiahao6635andZyy
JiahaoandCodex
Ruichen Zhou
Zyy
Akide LiuandClaude Fable 5