Make capability blocks optional and represent key budgets as named windows. Centralize validation and preserve unknown states for missing observations.
BREAKING CHANGE: CPR Link requires schema_version 2; v1 snapshots are no longer accepted.
Co-authored-by: Codex <noreply@openai.com>
Export authoritative budget access flags and keep monetary fields display-only
for peer consumers. Use the official usage_limit_reached error type for budget
exhaustion while preserving ordinary rate-limit cooldowns.
Apply fresh quota facts atomically with peer snapshots through the shared quota
writer, retaining connection, claim, and observation-time guards. Reuse the
existing sync worker and document the recovery contract.
Validated with 234 selected tests, strict workspace Clippy, and Rustfmt.
Co-authored-by: Codex <noreply@openai.com>
* feat(peer): add automatic discovery and scalable quota sharing
Export authorized direct-account pools and budgets through the CPR peer
protocol, with durable upstream discovery and immutable scheduling views.
Show shared-pool node quotas through common quota popovers and lazy account
details. Bound snapshot reads and export concurrency, reduce Redis and SQL
work, and keep only the latest observation for each upstream connection.
Co-authored-by: Codex <noreply@openai.com>
* refactor(peer): centralize upstream discovery and quota projections
Move peer synchronization into Admin, HTTP transport into Host, and expose
neutral Core scheduling signals through explicitly wired provider capabilities.
Preserve provider-visible model catalogs and independent quota disclosure,
with stale windows following the existing OAuth quota layout.
Cover cross-provider discovery, lifecycle fencing, and database leases, and
update the architecture and usage documentation.
Co-authored-by: Codex <noreply@openai.com>
* fix(ui): center usage card loading and empty states
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): unify peer subscription badges across account views
Share CPR identity rendering through AccountPlanBadge, project upstream metadata into dashboard and proxy account views, and align quota empty states and API badges.
Co-authored-by: Codex <noreply@openai.com>
* fix(peer): bound snapshot work and preserve quota windows
Keep summary reads off full snapshots, reject oversized model expansion early, and yield export work. Preserve daily and weekly unlimited budgets, hide empty token counters, and unify quota empty states.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Send upstream Ping frames every 25 seconds without a Pong deadline.
Keep downstream cancellation, business idle timeout and pool eviction
independent from heartbeat traffic, with bounded heartbeat writes.
Co-authored-by: Codex <noreply@openai.com>
Track inbound byte progress before WebSocket decoding so active uploads do not trip the heartbeat timeout. Reuse Axum handshake validation and report actual receive idle time.
Cover successive slow uploads and stalled partial frames, and document the downstream liveness contract.
Validation: 652 API and gateway tests passed; production API check, strict workspace Clippy, and formatting passed.
Co-authored-by: Codex <noreply@openai.com>
Return non-retryable client version errors and correct provider error types.
Keep safe user messages separate from operational diagnostics.
Unify error wording and document the conventions in the development skill.
Co-authored-by: Codex <noreply@openai.com>
Use passive upstream heartbeats and independent downstream liveness checks.
Reclaim unbound sockets after five idle minutes and release client-owned
resources on disconnect, with safe continuation ownership transfer.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): support configurable error protection rules
Replace capacity-specific freezing with bounded, configurable account error rules and shared attempt feedback.
Drop legacy settings without conversion and expose rule editing and freeze reasons in the admin UI.
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): preserve error protection scheduling boundaries
Keep xAI accounts excluded while recovery probes are pending, and cover
selection before and after recovery.
Separate scheduling cooldown reads from admin display details, share the
atomic Redis migration and selection logic, and use one policy revision.
Remove the unused adaptive concurrency reduction path and its tests.
Validation: 393 targeted backend tests, workspace Clippy with -D warnings,
Rustfmt, frontend type checking and build, and local service health checks.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Include the realtime WebSocket base URL in generated Codex configuration and document voice setup. Simplify configuration comments.
Track key reveal actions separately so opening client configuration and copying a key show loading only on the initiating button. Preserve duplicate request protection and stale request cancellation.
Co-authored-by: Codex <noreply@openai.com>
Keep incompatible plugins out of execution sets during automatic startup.
Require scoped confirmation for manual compatibility overrides and show
the stopped state and upgrade effects in the management UI.
Co-authored-by: Codex <noreply@openai.com>
Accept optional deployment strings for residency and account routing,
discard downstream values when unset, and isolate WebSocket connections
by the configured handshake headers.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Keep client context dates stable across midnight, continuation and replay
while retaining timezone and web search location overrides. Remove wall-clock
dependence from both request encoding and selected-account adaptation.
Cover appended day contexts, replay, and HTTP/WebSocket upstream payloads;
update the request-location contract. The regression fails before the fix.
Provider tests (1028), architecture checks (14), workspace strict Clippy,
Rustfmt and diff checks pass.
Refs #503; the reported repeated zero-cache requests are not yet confirmed
to share this cause.
Co-authored-by: Codex <noreply@openai.com>
Preserve request evidence and cold middleware boundaries across cancellation. Make backup auditing atomic, retain committed account-group results, and serialize restart operations.
Unify frontend stream authentication and session recovery, clear stale secrets, and remove redundant runtime paths. Correct CI permissions and database test URL handling.
Align documentation with current module responsibilities, APIs, and validation workflows, including both submodules.
Export business data and published hourly usage from a shared snapshot as
bounded gzip SQL archives, excluding request history and diagnostic data.
Run bounded retention cycles every minute, deleting oldest unlocked rows
with per-batch lock and statement deadlines.
Add real PostgreSQL export/restore and lock-contention coverage, document
the backup scope, and move detailed UI guidance into a help popover.
Validation: 4011 backend tests passed in partitions; Rustfmt, Clippy,
frontend lint/type checks, and actionlint passed. Resource-limited load
checks covered current-adapter million-row backups and a read-only policy
check on the existing 31-million-row database. Final popover interaction
checks were stopped at the user's request. Online restore is deferred.
Co-authored-by: Codex <noreply@openai.com>
Limit application data and log ownership changes to their top-level directories. Add a container check that reapplies installer permissions and verifies application startup.
Validation: first-install and repeated-install filesystem permission checks, Bash syntax, ShellCheck, Actionlint, and diff checks passed. Full local container validation was blocked by Docker Desktop bind-mount permission mapping.
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): add batch creation and geolocated testing
Co-authored-by: Codex <noreply@openai.com>
* feat(proxies): unify batch APIs and simplify management UI
Accept arrays on the existing create and test routes with ordered per-item
results, partial success, bounded concurrency and no automatic replay.
Streamline selected-proxy testing and creation forms, combine location
presentation, and generate bundled licenses from the npm flag package.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Codex <noreply@openai.com>
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Document server-side redaction of stored error details and timelines,
add the export route, and explain how to inspect diagnostic gaps.
Co-authored-by: Codex <noreply@openai.com>
Accept positive fractional days and expire request dump segments by elapsed time. Rotate small dump files by age, preserve archive timestamps, and document the retention window.
Co-authored-by: Codex <noreply@openai.com>
Aggregate analytics in PostgreSQL, reconcile synchronous usage with pending source changes, and preserve exact pagination and forecast totals across large histories.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Start downstream keepalives while admitted streaming requests await their first output, including middleware processing. Separate transport commitment from the replay barrier so heartbeat frames preserve safe retries and execution accounting.
Co-authored-by: Codex <noreply@openai.com>
Apply configured request locations to Desktop developer time contexts alongside environment contexts while preserving role and content-kind boundaries.
Cover date alignment, disabled overrides, proxy precedence, and HTTP/WebSocket requests. Update the location contract and troubleshooting documentation.
Co-authored-by: Codex <noreply@openai.com>
Use the current host manifest format and require restart confirmation on
all management UI paths. Document v3.18.1 as the minimum online upgrade
source while retaining old release manifest reads for supported rollbacks.
Retire middleware v3 and upstream_adapter v1 Fast projections after their
compatibility window. Align SDK and host declarations with the current
contracts, keep risk warnings and per-instance failure isolation, and
exercise native fast_mode values through real plugin subprocesses.
Keep deployment, API and SDK documentation focused on current behavior.
Co-authored-by: Codex <noreply@openai.com>
Declare the V2 remote compaction capability in generated Codex configuration and deployment examples. Document that CC Switch imports do not preserve the full capability configuration.
Co-authored-by: Codex <noreply@openai.com>
Record health component failures through operational diagnostics with transition deduplication. Preserve quota and catalog failure context without interrupting the account batch.
Co-authored-by: Codex <noreply@openai.com>
Extend the startup healthcheck grace period to five minutes and report elapsed migration time every fifteen seconds without changing published migrations.
Use one shutdown path for OS signals, internal cancellation, and managed restarts. Stop listening without waiting for active sessions, preserve bounded worker cleanup, and remove the obsolete connection drain timeout.
Cover shutdown entry points and worker cleanup with real HTTP lifecycle tests and document the deployment behavior.
Co-authored-by: Codex <noreply@openai.com>
Remove version migration narratives, consolidate repeated explanations, and organize settings and architecture references.
Co-authored-by: Codex <noreply@openai.com>
Export config.toml with provider bearer authentication and send supported connection and usage fields to CC Switch. Remove the separate auth.json output and size the configuration preview to its content.
Co-authored-by: Codex <noreply@openai.com>
Use read-only status checks for initial authentication and remove activity-driven renewal. Keep failed and newly queued requests waiting for the current refresh before replaying with the updated cookie.
Co-authored-by: Codex <noreply@openai.com>
Preserve native failure causes through store, provider, plugin, admin, and
worker boundaries, including secondary cleanup failures. Route operational
failures through the shared diagnostics sink with protected error details.
Use bounded nonblocking file logging with batched writes and reserved
warning/error capacity. Reserve observation capacity for failures and
request lifecycle records, and rate-limit overload warnings.
Validate error propagation and blocked-output HTTP, admin, SSE, and WebSocket
behavior; keep the local migration plan out of version control.
Co-authored-by: Codex <noreply@openai.com>
Renew active administrator sessions with atomic Redis expiry updates,
synchronized cookies, and idle and absolute lifetime limits. Preserve
revocation after logout and password changes.
Coordinate session recovery, bounded retries, error handling, and raw
responses through request plugins. Gate initial navigation in the router
and organize frontend API modules by their views.
Co-authored-by: Codex <noreply@openai.com>
Keep the glibc tuning value in config.yaml's app-runtime bridge and let
Compose inject it before the application starts. Leave tuning disabled
by default and document the 128 KiB preset, recreation, and upgrade steps.
Refs #338, #345
Co-authored-by: Codex <noreply@openai.com>
ZyyandCodex
dependabot[bot]
