Track pending charges in memory and settle them with a supervised worker.
Include pending costs in budget checks without retrying historical writes
at admission, and reject new admissions when the backlog reaches its limit.
Use idempotent per-key batches with write deadlines, adaptive batch sizes,
and bounded shutdown draining. Keep load tests outside the regular suite.
Co-authored-by: Codex <noreply@openai.com>
Group identical positive samples before numeric logarithm evaluation while retaining histogram boundaries and weights. Remove nine unused trend fields and synchronize frontend types, preview data, and API documentation.
Validate against the 30-million-row Docker dataset, matching retained statistics and reducing uncached today-summary median latency from 623 ms to 319 ms. Run 133 related tests, Clippy, formatting, frontend checks, and browser tab checks.
Keep dashboard and quota relative-time thresholds and future timestamps owned by the backend deployment timezone. Localize only the structured presentation in the frontend.
Co-authored-by: Codex <noreply@openai.com>
Move account metric and relative-time presentation to the frontend using raw API values. Tighten latency unit spacing and unify edit actions and page header sizing.
Co-authored-by: Codex <noreply@openai.com>
Restore quota labels, custom window durations, account usage panel width,
and consistent USD symbols. Return stable provider identity attribute keys
for frontend localization and refine login controls, copy, and alignment.
Pin hyper-util to the 0.1.21 registry release and remove the Git patch.
Tests were not rerun for this combined commit, as requested.
Co-authored-by: Codex <noreply@openai.com>
Preserve turn IDs and parent references across request metadata, input history, headers, Images and Desktop context. Update contract coverage and API documentation for unchanged turn identity across accounts.
Co-authored-by: Codex <noreply@openai.com>
Forward Live business headers through shared identity and transport filters,
preserving HTTP header bytes and repeated values. Scope tracking identifiers
to the selected or pinned account, remove client tracing and account-bound
metadata, and retain Live call ownership.
Preserve x-session-id and voice-session-id as business session references,
consistent with Codex 0.164.0. Validate standard HTTP header names in Core
and document the distinction between tracking and business identifiers.
Validation: 36 targeted nextest checks passed. Real-account checks through
the production Provider and LiveGateway completed SDP creation (201), WebRTC
connection and session.started, sideband events, and hangup (200), including
header-only business identifiers. Bidirectional RTP traffic was observed.
The deployed HTTP/UI path and speech recognition or spoken replies were not
validated; the earlier Voice session access denied error was not reproduced.
Co-authored-by: Codex <noreply@openai.com>
Keep client context dates stable across midnight, continuation and replay
while retaining timezone and web search location overrides. Remove wall-clock
dependence from both request encoding and selected-account adaptation.
Cover appended day contexts, replay, and HTTP/WebSocket upstream payloads;
update the request-location contract. The regression fails before the fix.
Provider tests (1028), architecture checks (14), workspace strict Clippy,
Rustfmt and diff checks pass.
Refs #503; the reported repeated zero-cache requests are not yet confirmed
to share this cause.
Co-authored-by: Codex <noreply@openai.com>
* feat(frontend): add English and Traditional Chinese locales
* fix(frontend): capitalize the English login key label
* fix(frontend): capitalize standalone English labels
* feat(frontend): add reactive localization and refine admin layouts
Replace DOM text translation with domain-based Vue I18n resources for English, Simplified Chinese, and Traditional Chinese. Localize shared controls, notifications, charts, and key usage while refining table alignment, menus, and compact labels.
Expose semantic usage-window and trend-metric identifiers from the API. Pin the UI and workbench dependencies to published feature commits and preserve the original font defaults.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Jimbb <14995924+jimbb@users.noreply.github.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Preserve request evidence and cold middleware boundaries across cancellation. Make backup auditing atomic, retain committed account-group results, and serialize restart operations.
Unify frontend stream authentication and session recovery, clear stale secrets, and remove redundant runtime paths. Correct CI permissions and database test URL handling.
Align documentation with current module responsibilities, APIs, and validation workflows, including both submodules.
Map input turn references with the same account identity as request metadata.
Limit the workspace preset to metadata usernames and remote namespaces;
preserve project names and executable paths to avoid path failures and
same-parent workspace collisions.
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): honor configured request body limits
* test(plugin-sdk): mirror upstream adapter module layout
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): preserve frozen request body budgets across callbacks
Carry the execution body budget through policy and attempt callbacks, and validate explicit-key model requests against their bound snapshot. Add regression coverage for configuration publication and document budget ownership and lifetime.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Expose the stored proxy ID through account queries and use it to display
the bound proxy name without matching redacted endpoints. Preserve
unchanged bindings and keep the preserve option for batch editing.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Export business data and published hourly usage from a shared snapshot as
bounded gzip SQL archives, excluding request history and diagnostic data.
Run bounded retention cycles every minute, deleting oldest unlocked rows
with per-batch lock and statement deadlines.
Add real PostgreSQL export/restore and lock-contention coverage, document
the backup scope, and move detailed UI guidance into a help popover.
Validation: 4011 backend tests passed in partitions; Rustfmt, Clippy,
frontend lint/type checks, and actionlint passed. Resource-limited load
checks covered current-adapter million-row backups and a read-only policy
check on the existing 31-million-row database. Final popover interaction
checks were stopped at the user's request. Online restore is deferred.
Co-authored-by: Codex <noreply@openai.com>
Record first-token timing from nonempty HTTP SSE data or WebSocket messages before JSON and event classification. Preserve semantic output, reasoning and text timing boundaries.
Co-authored-by: Codex <noreply@openai.com>
Preserve response.create field order and align OAuth query ordering with
current official Codex sources.
Stop adding the timing-metrics request header by default and remove the
four unused engine TTFT and token interval fields throughout the backend,
plugin observation contracts, and frontend. Keep rate calculations unchanged.
Co-authored-by: Codex <noreply@openai.com>
Share data columns and status filters between admin and key usage. Keep final error summaries in the error view and focus error details in a separate dialog.
Use logical request outcomes for key usage records and keep concurrency lists at a stable height without pagination.
Co-authored-by: Codex <noreply@openai.com>
Apply model allowlists and denylists before selecting search accounts.
Use unrestricted accounts when the request model cannot be determined,
and preserve plugin body rewrites after selection.
Co-authored-by: Codex <noreply@openai.com>
Skip new automatic redemptions above the configured remaining weekly
quota limit, leaving it unset by default and preserving pending retries.
Keep temporarily ineligible credits scheduled and expose the setting
beside the redemption lead time.
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): add concurrency details and SDK request context
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): version request-context frames and preserve failed snapshots
Co-authored-by: Codex <noreply@openai.com>
* fix(dev): sync workbench with request-context contracts
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): refine concurrency and request context handling
Preserve entry context and recursion scopes in retry and public management callbacks. Encode queued RPC frames once and use a dedicated account existence query for concurrency polling. Sync workbench packaging tooling and CI through the plugin submodule.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): automate expiring reset credits
Persist per-account plans and redemption keys, stagger daily discovery, and verify availability before consuming expiring credits.
Co-authored-by: Codex <noreply@openai.com>
* fix(ui): remove reset credit timing button background
Use the existing link variant to keep the control transparent in both idle and hover states.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): add batch creation and geolocated testing
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): unify batch APIs and simplify management UI
Accept arrays on the existing create and test routes with ordered per-item
results, partial success, bounded concurrency and no automatic replay.
Streamline selected-proxy testing and creation forms, combine location
presentation, and generate bundled licenses from the npm flag package.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Document server-side redaction of stored error details and timelines,
add the export route, and explain how to inspect diagnostic gaps.
Co-authored-by: Codex <noreply@openai.com>
Set the database default and untouched initial settings to five in the
unreleased 0032 migration, preserving saved concurrency settings.
Update the migration checksum and document the initial value.
Co-authored-by: Codex <noreply@openai.com>
* feat(scheduling): add plugin filtering and remove automatic switchback
Add scheduler v2 filtered delegation across native selection, affinity,
capacity waits, and lease retries. Keep plugin configuration and business
rules owned by plugins without legacy scheduler compatibility.
Remove automatic switchback from the runtime, SDK, and settings UI.
Migrate the existing settings JSON without creating new tables.
Co-authored-by: Codex <noreply@openai.com>
* fix(dev): align plugin source checks with scheduler v2
Update the workbench submodule to the v2-capable SDK and scheduler,
and document the explicit scheduler manifest version.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Collect request, retry, error and recovery evidence with bounded reads and
credential redaction. Keep ordinary detail responses small and expose a
shared download action next to the close button.
Preserve export metadata when limits are reached and deduplicate selected
errors without discarding business context based on generic field names.
Co-authored-by: Codex <noreply@openai.com>
Expose generic detail CRUD, aggregate contributions, and native pricing evaluation through Admin and the plugin SDK. Reuse existing request and statistics storage without schema changes; keep workflow state and recovery with callers.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep repository, commit, branch and worktree data intact while normalizing personal paths. Remove the Desktop identity preset and version shortcuts from privacy settings.
Synchronize automatic Desktop Git context versions from the existing request-scoped client identity in HTTP and WebSocket requests. Reuse official release updates, fixed versions and key overrides, and share context parsing with privacy rules. Preserve unknown or incomplete context and leave installation identity to its existing account owner.
Verified version field semantics against the official Desktop 26.1007.71326 bundle and Codex app-server initialization source. Validated provider tests, temporary HTTP/WS identity tests, architecture boundaries, strict Clippy, frontend lint/build and the preset UI.
Co-authored-by: Codex <noreply@openai.com>
Track short-lived failures by client key, thread, and turn. Skip RetryThenReturnError retries on subsequent requests, clear markers on success with version checks, and preserve other retry policies.
Co-authored-by: Codex <noreply@openai.com>
Preserve proxy configuration and account bindings while disabled and route
subsequent account requests directly. Restore the proxy when enabled.
Automatically unbind accounts on deletion in one transaction. Add the
status column, action menu, and disable/delete confirmation messages.
Refs #416
Co-authored-by: Codex <noreply@openai.com>
Execute each rule's steps in order with atomic rollback and migrate saved
single-action rules once to the canonical steps structure.
Consolidate workspace and Desktop presets, add drag ordering and step help,
and simplify the rule editor and preview controls.
Co-authored-by: Codex <noreply@openai.com>
Negotiate fast gzip for known-length admin JSON responses of at least
1 KiB while preserving streaming and model execution paths.
Cover encoding negotiation, body equivalence, the size threshold,
response headers, duplicate compression, and SSE first-event delivery.
Document the admin response compression contract.
Refs #432
Co-authored-by: Codex <noreply@openai.com>
Preserve upstream turn_rate_limit_exceeded errors and retry advice without
cooling the account or replaying the request inside the proxy.
Cover HTTP and WebSocket rejections plus streamed failures, and document
client-owned waiting and retries.
Co-authored-by: Codex <noreply@openai.com>
Distinguish credential revision conflicts from account store failures and
persist response cookies once across streaming errors and WebSocket reuse.
Keep Microsoft Store downloads first with a 30-second timeout, read official
fallback sizes through bounded HEAD requests, and correct Store size units.
Co-authored-by: Codex <noreply@openai.com>
Deliver HTTP/SSE and WebSocket events immediately while preserving bounded
recovery after replaceable preludes. Share prelude classification so response
metadata does not hide WebSocket connection-limit recovery.
Keep irreversible delivery, cancellation, middleware, and retry-budget guards.
Document the distinction between transport keepalive and event idle timeouts.
Refs #405
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
