Apply the global request profile to account catalog discovery, warmup,
and diagnostic routing. Freeze each operation's identity through the
existing provider profile resolver.
Refresh verified offline releases and centralize their version, artifact,
and environment defaults. Cover ZIP64 MSIX metadata and keep release
update tests independent of the current bundled versions.
Fixes#703
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
* feat(settings): remove request history retention cap
Allow positive retention days beyond 31 throughout the form, domain rules,
and database constraint. Keep the existing default and saved settings.
Bound cleanup and account usage queries by stored data so large retention
windows remain safe without expanding empty history.
Co-authored-by: Codex <noreply@openai.com>
* test(admin): align retention policy coverage with positive windows
Accept long request retention windows while preserving zero rejection
for each target and independent event and audit retention settings.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Match independently scheduled hour and minute pairs while claiming each local minute once. Keep the existing string setting and database constraint, and edit the rules as tags using UI v0.11.0.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use the last successful catalog for the same account, credential revision, and plan until a refresh replaces it. Apply the same exclusions in memory and in PostgreSQL while preserving explicit allowlists and accounts with no catalog.
Co-authored-by: Codex <noreply@openai.com>
* fix(egress): honor deployment proxies for unbound outbound requests
Prefer the proxy selected for the request. Otherwise apply the deployment proxy and bypass rules consistently to HTTP and WebSocket connections, including background downloads. Keep explicit direct probes separate.
Co-authored-by: Codex <noreply@openai.com>
* fix(openai): preserve WebSocket dial errors
Recover the OS error or I/O kind from Hyper without retaining the endpoint. Keep refused connections distinguishable for both direct and proxied WebSocket dials.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use each upstream handshake's message-size limit to select HTTP before
uploading oversized response.create frames. Remove fixed thresholds and
thread size hysteresis while preserving continuation replay and cleanup.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Observe top-level output_config.effort before the OpenAI encoder rejects
Messages payloads. Reuse the protocol parser without inferring an effort
from thinking budgets or changing upstream conversion behavior.
Cover absent and explicit effort values, native Messages forwarding, and
Messages-to-Responses conversion. Document the observation contract.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Treat x-retry-metadata: NO_MORE_RETRY as a hard signal to skip
same-account backoff and transport recovery, even when Retry-After
is within maxRetryAfterSeconds. Capacity failures still rotate under
the existing policy; server_error still returns the upstream error.
Co-authored-by: Cursor Agent <cursoragent@cursor.com>
Reuse connection-scoped peer discovery for native HTTP and WebSocket forwarding. Strip the route header for ordinary upstreams and leave explicit plugin forwarding changes to plugins.
Co-authored-by: Codex <noreply@openai.com>
Limit default tier omission to Messages-to-OAuth conversion so native Responses retain their requested tier and routing hint.
Co-authored-by: Codex <noreply@openai.com>
Persist validated directories per credential revision. Restore them in bulk and refresh only missing, expired, or changed accounts with paced background requests. Filter large pools using current per-account evidence while preserving unknown and explicitly allowed candidates.
Co-authored-by: Codex <noreply@openai.com>
* feat(accounts): redeem reset credits when weekly quota runs low
Co-authored-by: Codex <noreply@openai.com>
* fix(accounts): observe weekly quota recovery after the last reset credit
Keep checking the local quota snapshot while recovery is unconfirmed. Once recovery is observed with no cards left, return to daily discovery.
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Discover models per account so the Codex picker includes models unique to an eligible group member. Use account-specific catalog evidence when selecting a credential for native Responses requests.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use saved request and upstream facts to show the same error origin in the usage list and detail. Distinguish WebSocket error statuses from HTTP responses and preserve unknown delivery state for intermediate attempts.
Update the Linux OpenSSL bindings to 0.10.80 to address the dependency audit findings.
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Support Responses, Chat Completions and Messages ingress with Responses
or Messages API upstreams in the existing OpenAI provider.
Share generation admission and delivery, preserve native protocol payloads,
and translate cross-protocol tools, reasoning, streams and usage. Add
Messages token counting and editable upstream protocol settings.
Co-authored-by: Codex <noreply@openai.com>
* feat(keys): add explicit budget windows with safe retries
Add revision-checked daily and weekly windows across admission, settlement
and queries. Reuse the existing budget ledger for atomic window updates,
latest-operation replay and audit records.
Expose typed SDK callbacks while keeping account associations and cycle
decisions in plugins.
Refs #658
Co-authored-by: Codex <noreply@openai.com>
* fix(keys): preserve budget accounting across window changes
Keep restored balances when historical charges are unavailable and reject window changes that would require those charges. Honor future start times after release and report actual spending windows to peers.
Require an explicit null to release a window through the plugin SDK.
Co-authored-by: Codex <noreply@openai.com>
* fix(plugins): preserve budget window precision across SDK calls
Co-authored-by: Codex <noreply@openai.com>
---------
Co-authored-by: Zyy <zyycn@users.noreply.github.com>
Co-authored-by: Codex <noreply@openai.com>
Use a single five-field Cron expression and allow lightweight warmup when
quota windows lack active evidence, without extra quota refreshes.
Reset saved schedules and disable warmup in migration 0040 while keeping
the configured model.
Co-authored-by: Codex <noreply@openai.com>
Publish an immutable channel snapshot with each release and advance a fixed release pointer only after public assets pass verification. Check the exact platform package before notifying clients.
Co-authored-by: Codex <noreply@openai.com>
Use the configured affinity mode for content and cache-key bindings, including strict waiting and binding store failures. Cover queue rejection, cancellation, migration, and preferred spillover, and document the scheduling boundaries.
Refs #623
Co-authored-by: Codex <noreply@openai.com>
Use the client cache key or the opening messages as a tenant-scoped scheduling preference. Keep explicit sessions and continuation ownership separate, and allow spillover when the preferred account is busy.
Refs #622
Co-authored-by: Codex <noreply@openai.com>
Let OpenAI accounts send explicitly allowlisted model IDs upstream while retaining catalog checks for other accounts. Update the account editor and connection test to support custom IDs.
Co-authored-by: Codex <noreply@openai.com>
Count incomplete requests as errors, exclude recovered and cancelled requests from success rates, and preserve gaps for missing samples.
Co-authored-by: Codex <noreply@openai.com>
Distinguish connection failures from uncertain authorization results and retain redacted diagnostic causes. Increase token connection timeout to 30 seconds and total request timeout to 60 seconds.
Co-authored-by: Codex <noreply@openai.com>
Notify idle clients with Close 1000 after upstream loss while preserving settlement and queued requests. Align idle transport termination detection with Codex and document the reconnect contract.
Co-authored-by: Codex <noreply@openai.com>
koeriaandCursor Agent
Ke WangandCodex