Conversation
Co-authored-by: sbrusse-git <sbrusse@gmail.com> (cherry picked from commit 2970ec6)
Use the bound source's effective threshold to enable optional failback and the candidate's effective threshold to evaluate headroom. A candidate override of zero does not authorize unknown or exhausted usage. Preserve pin, scope and hard-lock boundaries and share the decision between preview and resolve. Track live quota-window observation times privately so credit or partial cache writes cannot manufacture fresh capacity. The failback prime path bypasses stale observation caches while preserving attempt backoff, leases and passive main refresh intent. Ordinary quota storage and non-failback cache rules are unchanged. Retain the complete per-account threshold contribution, including GUI, translations and atomic deletion intent, from b3c42ba and the priority failback contribution from 2970ec6. Move source routing cases to a registered sibling file without raising its cap. Keep quota-prime HTTP fixtures in unique homes, drain producers/reaps and use the existing test-only ACL runners; this fixture makes no OS ACL coverage claim. Co-authored-by: Aleksei Chistiakov <aleks00799@gmail.com> Co-authored-by: sbrusse-git <sbrusse@gmail.com>
…ount-threshold-failback
Contributor
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Contributor
|
✅ Deterministic PR hygiene checks passed. |
Owner
리뷰 · 우선순위 69 / 80이 PR은 아직 열려 있는 #4020(계정마다 자동 전환 임계값)과 #3709(우선순위 failback)을 라인 - 메인테이너의 판단이 필요한 지점 머지 시점에 #4020·#3709를 무효/중복으로 닫을지. 너의 추천 방향은 유지하세요. 먼저 핀 안내 CI 실패를 이 브랜치에서 맞추고, 머지 전에 #4020·#3709 닫을 계획을 잡으세요. 초안이 풀리고 합의된 게이트가 초록이며 보안 한 바퀴가 돌면 통합본으로 가져가도 됩니다. 프리뷰 배포 이야기는 이 범위 밖입니다. 이 댓글은 grok-bot이 작성했습니다 |
3 tasks
Owner
|
Superseded by #5609, which is open and not yet merged. Per-account auto-switch thresholds and opt-in priority failback (d5bdb95, 88c3274, 3305154, 64b097c) are reimplemented there on current |
lidge-jun
added a commit
that referenced
this pull request
Sep 23, 2026
…xes (L6) (#5609) * fix(codex): map the collaboration_mode prompt layer (cherry picked from commit 7953e61) (cherry picked from commit 9df7867) * fix(codex): reconcile explicit v1 injection with native feature state Carry the v1 injection reconcile from 96dcf81, ab917f3, and 487c1cf on current dev. Keep the native feature transition inside the write boundary and publish a witness for the rederived committed bytes. Resolve the native toggle before lock acquisition, with no synchronous module load under the lock. Move and extend focused regression coverage; layout registration follows 39fb323 and b698cfa. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(codex): bound reasoning metadata bootstrap during catalog sync Carry catalog-sync metadata bootstrap from 719d902 and its documentation link from 73aa8d5. Wait at most two seconds for either a fresh or shared metadata fetch while preserving the existing snapshot on failure. Keep routed effort reads free of refresh work and cover stalled fetches plus both catalog sync paths. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): recover exact model refusals from WebSocket error envelopes (cherry picked from commit 6443712) Carries 1b55d81 (fix(codex): recover exact model refusals from WebSocket error envelopes) together with c7e06af (test: extract pool retry harness without growing the server auth suite) so no intermediate commit exceeds a file-size cap. * feat(logs): record the upstream-served model and flag wire/served mismatches is-gpt-nerfed-style auditability: the log already carried the routed model and, on some paths, the upstream-served one, but the GUI rendered resolvedModel alone and a virtual-model rewrite could overwrite the served value before it was ever compared. Record the upstream-served model on a dedicated servedModel field (openai-model header and response body), keep the exact wire id on wireModel when a route/virtual rewrite diverges it from the client-facing model, and render 'wire → served' in the Logs model column when they differ. (cherry picked from commit 10e3441) (cherry picked from commit 632cf0d) * test(subagents): isolate V2 catalog state from host processes (cherry picked from commit 44539f0) * fix(responses): narrow stale spend settlement handling Reimplements bba58c3 for deferred settlement after the spend-ledger lease ends. Drop only SPEND_LEDGER_OWNER_NOT_HELD for already reserved sends; preserve pending IDs and propagate other owner or storage failures. Add regression coverage for lease release, failure propagation, and retry without double settlement. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(logs): preserve reroute diagnostics across locales Reimplements 24d8a0c so reroute copy compares the upstream-served model with the model sent on the wire in all ten locales. Translate the wire-model label and nearby diagnostics into Turkish and Vietnamese. Reimplements 4ea2059 by keeping the full model tooltip on rerouted log rows and showing both models in the detail dialog, with focused title regressions. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(logs): document model identities and capture the combined view (cherry picked from commit 271fde4) * fix(providers): preserve case-varied effort overrides (cherry picked from commit bff4129) (cherry picked from commit 8b0b5bb297f174548212c5e9c5eee7132cd10c81) (cherry picked from commit 65a94a3) * fix(providers): fold case on nested effort-map merge A case-varied operator key in modelReasoningEffortMap claimed nothing: nestedMapFill kept the registry-spelled row beside it, and the case-folded runtime lookup hit the registry row first. The outer key now claims case-insensitively while the claimed row's inner entries still fill underneath the operator's inner map. (cherry picked from commit 0fa7712) (cherry picked from commit 1087c9f7e14b3aab15be60db7d7d8c7595c86cb4) (cherry picked from commit d0f5b83) * fix(management): validate modelSupportsVerbosity record shape The provider management validator shape-checked sibling capability records but not modelSupportsVerbosity, so an invalid value (array, non-boolean values, empty keys) could persist and reach consumers unchecked. (cherry picked from commit 3f5c4f8) (cherry picked from commit faaa2e98f05698f7b665f2cfb90b79e8ace795e4) Carries ffb6f91 (fix(management): validate modelSupportsVerbosity record shape) together with e54086b (test(management): isolate verbosity validation regression) so no intermediate commit exceeds a file-size cap. * fix(catalog): accept parser sentinels none/minimal in effort compatibility (cherry picked from commit ceb8807) (cherry picked from commit 9dbbf8f983a5820eb5c49770c5bed7e320dbda12) (cherry picked from commit c7e976d) * fix(catalog): fold policy provenance and exclude retired DeepSeek rows Reimplement 33e5ce5 and 87ab453 so case-varied operator rows retain correct provenance through registryEntry. Reimplement d11f35f to clamp case-equal API-key limits and move exclusion coverage into a registered sibling test. Carry e4b6cc2 to exclude retired DeepSeek V4 Pro rows on DeepSeek and OpenCode Go. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(kimi): add Responses preset and K3 256K catalog entry Reimplement 7db37ed and 63d3f19 to expose k3-256k with matching capability and price coverage. Carry 351f507, 63755ef and 82ff04d as an additive kimi-responses preset that shares the existing Kimi login. Carry 7e547bf and 5ebd93d to align API-reference estimates, unknown K2.8 alias cost, branding and translated guides with the current registry. Carry the c86bc00 screenshot; retain the K2.8 migration already on dev. Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(prompt): preserve external TOML escaped paths (cherry picked from commit 1131bf5) (cherry picked from commit 38d56c5a6e527779b26eefb7c5d61b0adb3dd14e) (cherry picked from commit 9e0404f) * fix(codex-prompt): close base variant create bypass and bound PUT body A caller-supplied id used the delete-or-edit existence check, so naming a syntactically valid but missing id bypassed the variant cap. Caller ids are now edit-only. The PUT base route also stored the raw body without normalization or the 64 KiB cap used elsewhere. Signed-off-by: luvs01 <27862058+luvs01@users.noreply.github.com> (cherry picked from commit 0be3292) (cherry picked from commit 8540f69c15eea4f329bdc8e3c60d9e0c519db320) (cherry picked from commit fce8ffb) * fix(integrations): refuse unsafe TOML integers instead of rewriting them rounded tomlScalar accepted any finite number, but Bun.TOML.parse already rounds integers outside JavaScript's safe range, so rewriting a user config silently changed their values. Throw UnserializableValueError so apply/disable refuse and leave the file untouched. (cherry picked from commit bb125d6) (cherry picked from commit 8b86eb0e6dd7a0d14d7632ec443141bfe819462b) (cherry picked from commit 0f0383b) * docs(config): document the unsafe-TOML-integer rewrite refusal Managed TOML rewrites now state that an integer outside JavaScript's safe range refuses the write and leaves the file unchanged, matching the guard in src/integrations/serialize.ts. (cherry picked from commit 28c2bab) (cherry picked from commit ea030be176a4f5ade27e83af25fe2816cfd5eba2) (cherry picked from commit a5b551c) * fix(gui): protect parked prompt drafts during save Reimplement 1da10c9 to retain parked drafts and confirm before discarding them. Reimplement 2f4f8f9 to clarify the save action in the guide and all locales. Revalidate the displayed layer on confirmation and bind the confirmation to its original target. Add a regression for an invalid edit made while confirmation is open; local checks were not run. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(pr): capture prompt save confirmation with synthetic data (cherry picked from commit 9f2f2eac8a3192e31bcecc17cb83e7117d0ddb0e) (cherry picked from commit 1e25a21) * fix(diagnostics): bound project config reads Reimplement 62c8932 to limit discovered project config files to regular files of at most 1 MiB. Reimplement 3a5674f to use nonblocking descriptor reads and reject FIFO replacements. Reject files whose size or timestamps change during the read, and document the diagnostic boundary. Author focused coverage for symlinks, size limits, and FIFO refusal; local checks were not run. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(codex): distinguish mapped collaboration from unknown layers Reimplement e352aee against the scaffolded collaboration_mode mapping. Assert that an absent mapped collaboration section is not-rendered while unknown layers remain unmapped. Local tests and typecheck were not run under the lane rule. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(i18n): localize management API table headings Translate all remaining English method-and-path headings in the Korean management API reference. Translate all notable-errors headings and the matching prose reference in Traditional Chinese. Keep route names and API details unchanged; local builds were not run under the lane rule. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * refactor(config): extract persisted mutation into a config leaf Move the persisted mutation types, one-shot test seam, and retry/rebase loop unchanged into src/config/persisted-mutation.ts. Keep the src/config.ts public exports and claim the new leaf in structure ownership docs. This prepares the independent reimplementation of 663e2a2; no original commit content is carried in group a. * fix(config): back up non-object configs before repair Reimplement 663e2a2 on the current config facade: only a non-array object enters the defaults repair path. Back up top-level arrays, primitives, and null before falling back, preserving the original bytes. Add a focused sibling regression test, register it in both layout maps, and document the recovery contract. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(codex): compose account thresholds with priority failback Reimplement #5572 from d5bdb95, 88c3274, 3305154 and 64b097c on current dev. Add per-account usage thresholds and optional priority failback across config, API, CLI, dashboard and documentation. Filter every candidate in the selected higher-priority tier by fresh quota evidence, headroom, refusal and threshold before bound-task failback; cover stale and fresh same-tier accounts. Carry the account-card screenshot, translated locale copy and focused regression coverage. Co-authored-by: Aleksei Chistiakov <aleks00799@gmail.com> Co-authored-by: sbrusse-git <sbrusse@gmail.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(gui): keep the carried dialog and account-pool probes compiler-clean React Doctor flagged five react-compiler errors in files this branch changes. CustomLayerDialog declared its save closures, which hand the normalized body to onSave, before the lint useMemo, so the compiler could not preserve that memoization; they now follow it, matching dev's order. The account-pool test probes assigned hook results to outer variables during render and read Date.now() in render; they now assign in useLayoutEffect and compute the cold apiBase outside render, the pattern codex-account-pool-stale-refresh.test.tsx already uses. * fix(codex): keep the stale-only reasoning metadata refresh on the read path Review of the carried catalog-sync bootstrap found that removing dev's read-path refresh left a long-running server without Codex integration holding an expired ladder indefinitely. Restore dev's stale-only refresh (a missing snapshot is still never fetched on the request path) alongside the bounded sync bootstrap, and pin both cases in a regression. * fix(logs): bound the upstream-served model and make it filterable The served model comes from the upstream response, so it is now persisted only when it is a plausible model identifier of at most 200 characters. The Logs model filter offers and matches the served model that the row displays. * fix(prompt): decode escaped instruction paths in the TOML read fallback When Bun's parser rejects a document for an unrelated value, the line fallback returned the raw quoted literal for a path using a unicode escape. It now decodes the full TOML basic-string escape set in a read-only helper and fails closed on a malformed escape; the writer's restricted decoder is unchanged. * fix(config): keep valid account thresholds and reject non-boolean failback writes One malformed threshold entry dropped the whole map on load, and the next unrelated save persisted the loss; only the invalid entry is dropped now, with a warning. A write candidate with a non-boolean codexAccountPriorityFailback is rejected instead of being saved as false; a hand-edited file still degrades. * docs(i18n): localize served-model log fields and prompt guide links Translate the servedModel/wireModel log contract into the fr, ja, ko, ru, tr and zh-tw management API references, and point the ko, ja, ru and zh-cn prompt guide links at their localized pages. * fix(codex): restore v1 reconcile preimages when the coordinator commit fails The v1 path toggles the native flag and writes artifacts inside the coordinator callback, but assertPublished and the coordinator commit run after it returns, outside the restoration path. An optional post-callback failure hook in the write lock now restores config, profile, journal and the v1 flag while both locks are held; other callers keep their existing behaviour. Regressions cover a post-toggle commit failure and a post-toggle publish conflict. * fix(logs): drop a served model the secret redactor would change The served-model sanitizer bounded shape and length, but credential-shaped text fits the identifier alphabet. The shared sanitizer, used at every write and read-back path, now also drops a value that redactSecretString would alter. The regression feeds a credential-shaped value through the response path and both direct ingress paths. * fix: address automated review on the provider guides and a test teardown The fr, ja, ko, ru and tr provider guides still said eight presets use OAuth login while their own registry breakdown lists more; they now follow the English guide, which states no count. The cost-cap evidence test removes its temporary home inside finally, so a rejected flush can no longer leave it behind. * refactor(logs): share the model identity log fields below the size threshold The served-model fixes pushed src/server/request-log.ts to 2008 lines, over the file-size ratchet's 2000-line threshold for files without a recorded cap. The two identical served/resolved/wire field projections now come from one helper beside sanitizeServedModel in src/usage/log.ts; behaviour is unchanged. * test(config): place the non-object backup test in its seeded config domain The layout oracle requires an explicit mapping to agree with the regex seed, and config-*.test.ts seeds to the config domain. The test moves unchanged from tests/server to tests/config and both layout maps say config. --------- Signed-off-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: Aleksei Chistiakov <aleks00799@gmail.com> Co-authored-by: sbrusse-git <sbrusse@gmail.com>
Dylan-Liew
pushed a commit
to Dylan-Liew/opencodex
that referenced
this pull request
Sep 23, 2026
…xes (L6) (lidge-jun#5609) * fix(codex): map the collaboration_mode prompt layer (cherry picked from commit 7953e61) (cherry picked from commit 9df7867) * fix(codex): reconcile explicit v1 injection with native feature state Carry the v1 injection reconcile from 96dcf81, ab917f3, and 487c1cf on current dev. Keep the native feature transition inside the write boundary and publish a witness for the rederived committed bytes. Resolve the native toggle before lock acquisition, with no synchronous module load under the lock. Move and extend focused regression coverage; layout registration follows 39fb323 and b698cfa. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> * fix(codex): bound reasoning metadata bootstrap during catalog sync Carry catalog-sync metadata bootstrap from 719d902 and its documentation link from 73aa8d5. Wait at most two seconds for either a fresh or shared metadata fetch while preserving the existing snapshot on failure. Keep routed effort reads free of refresh work and cover stalled fetches plus both catalog sync paths. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(codex): recover exact model refusals from WebSocket error envelopes (cherry picked from commit 6443712) Carries 1b55d81 (fix(codex): recover exact model refusals from WebSocket error envelopes) together with c7e06af (test: extract pool retry harness without growing the server auth suite) so no intermediate commit exceeds a file-size cap. * feat(logs): record the upstream-served model and flag wire/served mismatches is-gpt-nerfed-style auditability: the log already carried the routed model and, on some paths, the upstream-served one, but the GUI rendered resolvedModel alone and a virtual-model rewrite could overwrite the served value before it was ever compared. Record the upstream-served model on a dedicated servedModel field (openai-model header and response body), keep the exact wire id on wireModel when a route/virtual rewrite diverges it from the client-facing model, and render 'wire → served' in the Logs model column when they differ. (cherry picked from commit 10e3441) (cherry picked from commit 632cf0d) * test(subagents): isolate V2 catalog state from host processes (cherry picked from commit 44539f0) * fix(responses): narrow stale spend settlement handling Reimplements bba58c3 for deferred settlement after the spend-ledger lease ends. Drop only SPEND_LEDGER_OWNER_NOT_HELD for already reserved sends; preserve pending IDs and propagate other owner or storage failures. Add regression coverage for lease release, failure propagation, and retry without double settlement. Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(logs): preserve reroute diagnostics across locales Reimplements 24d8a0c so reroute copy compares the upstream-served model with the model sent on the wire in all ten locales. Translate the wire-model label and nearby diagnostics into Turkish and Vietnamese. Reimplements 4ea2059 by keeping the full model tooltip on rerouted log rows and showing both models in the detail dialog, with focused title regressions. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(logs): document model identities and capture the combined view (cherry picked from commit 271fde4) * fix(providers): preserve case-varied effort overrides (cherry picked from commit bff4129) (cherry picked from commit 8b0b5bb297f174548212c5e9c5eee7132cd10c81) (cherry picked from commit 65a94a3) * fix(providers): fold case on nested effort-map merge A case-varied operator key in modelReasoningEffortMap claimed nothing: nestedMapFill kept the registry-spelled row beside it, and the case-folded runtime lookup hit the registry row first. The outer key now claims case-insensitively while the claimed row's inner entries still fill underneath the operator's inner map. (cherry picked from commit 0fa7712) (cherry picked from commit 1087c9f7e14b3aab15be60db7d7d8c7595c86cb4) (cherry picked from commit d0f5b83) * fix(management): validate modelSupportsVerbosity record shape The provider management validator shape-checked sibling capability records but not modelSupportsVerbosity, so an invalid value (array, non-boolean values, empty keys) could persist and reach consumers unchecked. (cherry picked from commit 3f5c4f8) (cherry picked from commit faaa2e98f05698f7b665f2cfb90b79e8ace795e4) Carries ffb6f91 (fix(management): validate modelSupportsVerbosity record shape) together with e54086b (test(management): isolate verbosity validation regression) so no intermediate commit exceeds a file-size cap. * fix(catalog): accept parser sentinels none/minimal in effort compatibility (cherry picked from commit ceb8807) (cherry picked from commit 9dbbf8f983a5820eb5c49770c5bed7e320dbda12) (cherry picked from commit c7e976d) * fix(catalog): fold policy provenance and exclude retired DeepSeek rows Reimplement 33e5ce5 and 87ab453 so case-varied operator rows retain correct provenance through registryEntry. Reimplement d11f35f to clamp case-equal API-key limits and move exclusion coverage into a registered sibling test. Carry e4b6cc2 to exclude retired DeepSeek V4 Pro rows on DeepSeek and OpenCode Go. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(kimi): add Responses preset and K3 256K catalog entry Reimplement 7db37ed and 63d3f19 to expose k3-256k with matching capability and price coverage. Carry 351f507, 63755ef and 82ff04d as an additive kimi-responses preset that shares the existing Kimi login. Carry 7e547bf and 5ebd93d to align API-reference estimates, unknown K2.8 alias cost, branding and translated guides with the current registry. Carry the c86bc00 screenshot; retain the K2.8 migration already on dev. Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(prompt): preserve external TOML escaped paths (cherry picked from commit 1131bf5) (cherry picked from commit 38d56c5a6e527779b26eefb7c5d61b0adb3dd14e) (cherry picked from commit 9e0404f) * fix(codex-prompt): close base variant create bypass and bound PUT body A caller-supplied id used the delete-or-edit existence check, so naming a syntactically valid but missing id bypassed the variant cap. Caller ids are now edit-only. The PUT base route also stored the raw body without normalization or the 64 KiB cap used elsewhere. Signed-off-by: luvs01 <27862058+luvs01@users.noreply.github.com> (cherry picked from commit 0be3292) (cherry picked from commit 8540f69c15eea4f329bdc8e3c60d9e0c519db320) (cherry picked from commit fce8ffb) * fix(integrations): refuse unsafe TOML integers instead of rewriting them rounded tomlScalar accepted any finite number, but Bun.TOML.parse already rounds integers outside JavaScript's safe range, so rewriting a user config silently changed their values. Throw UnserializableValueError so apply/disable refuse and leave the file untouched. (cherry picked from commit bb125d6) (cherry picked from commit 8b86eb0e6dd7a0d14d7632ec443141bfe819462b) (cherry picked from commit 0f0383b) * docs(config): document the unsafe-TOML-integer rewrite refusal Managed TOML rewrites now state that an integer outside JavaScript's safe range refuses the write and leaves the file unchanged, matching the guard in src/integrations/serialize.ts. (cherry picked from commit 28c2bab) (cherry picked from commit ea030be176a4f5ade27e83af25fe2816cfd5eba2) (cherry picked from commit a5b551c) * fix(gui): protect parked prompt drafts during save Reimplement 1da10c9 to retain parked drafts and confirm before discarding them. Reimplement 2f4f8f9 to clarify the save action in the guide and all locales. Revalidate the displayed layer on confirmation and bind the confirmation to its original target. Add a regression for an invalid edit made while confirmation is open; local checks were not run. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(pr): capture prompt save confirmation with synthetic data (cherry picked from commit 9f2f2eac8a3192e31bcecc17cb83e7117d0ddb0e) (cherry picked from commit 1e25a21) * fix(diagnostics): bound project config reads Reimplement 62c8932 to limit discovered project config files to regular files of at most 1 MiB. Reimplement 3a5674f to use nonblocking descriptor reads and reject FIFO replacements. Reject files whose size or timestamps change during the read, and document the diagnostic boundary. Author focused coverage for symlinks, size limits, and FIFO refusal; local checks were not run. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * test(codex): distinguish mapped collaboration from unknown layers Reimplement e352aee against the scaffolded collaboration_mode mapping. Assert that an absent mapped collaboration section is not-rendered while unknown layers remain unmapped. Local tests and typecheck were not run under the lane rule. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * docs(i18n): localize management API table headings Translate all remaining English method-and-path headings in the Korean management API reference. Translate all notable-errors headings and the matching prose reference in Traditional Chinese. Keep route names and API details unchanged; local builds were not run under the lane rule. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * refactor(config): extract persisted mutation into a config leaf Move the persisted mutation types, one-shot test seam, and retry/rebase loop unchanged into src/config/persisted-mutation.ts. Keep the src/config.ts public exports and claim the new leaf in structure ownership docs. This prepares the independent reimplementation of 663e2a2; no original commit content is carried in group a. * fix(config): back up non-object configs before repair Reimplement 663e2a2 on the current config facade: only a non-array object enters the defaults repair path. Back up top-level arrays, primitives, and null before falling back, preserving the original bytes. Add a focused sibling regression test, register it in both layout maps, and document the recovery contract. Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * feat(codex): compose account thresholds with priority failback Reimplement lidge-jun#5572 from d5bdb95, 88c3274, 3305154 and 64b097c on current dev. Add per-account usage thresholds and optional priority failback across config, API, CLI, dashboard and documentation. Filter every candidate in the selected higher-priority tier by fresh quota evidence, headroom, refusal and threshold before bound-task failback; cover stale and fresh same-tier accounts. Carry the account-card screenshot, translated locale copy and focused regression coverage. Co-authored-by: Aleksei Chistiakov <aleks00799@gmail.com> Co-authored-by: sbrusse-git <sbrusse@gmail.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> * fix(gui): keep the carried dialog and account-pool probes compiler-clean React Doctor flagged five react-compiler errors in files this branch changes. CustomLayerDialog declared its save closures, which hand the normalized body to onSave, before the lint useMemo, so the compiler could not preserve that memoization; they now follow it, matching dev's order. The account-pool test probes assigned hook results to outer variables during render and read Date.now() in render; they now assign in useLayoutEffect and compute the cold apiBase outside render, the pattern codex-account-pool-stale-refresh.test.tsx already uses. * fix(codex): keep the stale-only reasoning metadata refresh on the read path Review of the carried catalog-sync bootstrap found that removing dev's read-path refresh left a long-running server without Codex integration holding an expired ladder indefinitely. Restore dev's stale-only refresh (a missing snapshot is still never fetched on the request path) alongside the bounded sync bootstrap, and pin both cases in a regression. * fix(logs): bound the upstream-served model and make it filterable The served model comes from the upstream response, so it is now persisted only when it is a plausible model identifier of at most 200 characters. The Logs model filter offers and matches the served model that the row displays. * fix(prompt): decode escaped instruction paths in the TOML read fallback When Bun's parser rejects a document for an unrelated value, the line fallback returned the raw quoted literal for a path using a unicode escape. It now decodes the full TOML basic-string escape set in a read-only helper and fails closed on a malformed escape; the writer's restricted decoder is unchanged. * fix(config): keep valid account thresholds and reject non-boolean failback writes One malformed threshold entry dropped the whole map on load, and the next unrelated save persisted the loss; only the invalid entry is dropped now, with a warning. A write candidate with a non-boolean codexAccountPriorityFailback is rejected instead of being saved as false; a hand-edited file still degrades. * docs(i18n): localize served-model log fields and prompt guide links Translate the servedModel/wireModel log contract into the fr, ja, ko, ru, tr and zh-tw management API references, and point the ko, ja, ru and zh-cn prompt guide links at their localized pages. * fix(codex): restore v1 reconcile preimages when the coordinator commit fails The v1 path toggles the native flag and writes artifacts inside the coordinator callback, but assertPublished and the coordinator commit run after it returns, outside the restoration path. An optional post-callback failure hook in the write lock now restores config, profile, journal and the v1 flag while both locks are held; other callers keep their existing behaviour. Regressions cover a post-toggle commit failure and a post-toggle publish conflict. * fix(logs): drop a served model the secret redactor would change The served-model sanitizer bounded shape and length, but credential-shaped text fits the identifier alphabet. The shared sanitizer, used at every write and read-back path, now also drops a value that redactSecretString would alter. The regression feeds a credential-shaped value through the response path and both direct ingress paths. * fix: address automated review on the provider guides and a test teardown The fr, ja, ko, ru and tr provider guides still said eight presets use OAuth login while their own registry breakdown lists more; they now follow the English guide, which states no count. The cost-cap evidence test removes its temporary home inside finally, so a rejected flush can no longer leave it behind. * refactor(logs): share the model identity log fields below the size threshold The served-model fixes pushed src/server/request-log.ts to 2008 lines, over the file-size ratchet's 2000-line threshold for files without a recorded cap. The two identical served/resolved/wire field projections now come from one helper beside sanitizeServedModel in src/usage/log.ts; behaviour is unchanged. * test(config): place the non-object backup test in its seeded config domain The layout oracle requires an explicit mapping to agree with the regex seed, and config-*.test.ts seeds to the config domain. The test moves unchanged from tests/server to tests/config and both layout maps say config. --------- Signed-off-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: luvs01 <27862058+luvs01@users.noreply.github.com> Co-authored-by: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Co-authored-by: panyuanyuan <panyuanyuan@hetao101.com> Co-authored-by: Aleksei Chistiakov <aleks00799@gmail.com> Co-authored-by: sbrusse-git <sbrusse@gmail.com> (cherry picked from commit b197bc9)
This was referenced Sep 23, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Consolidate #4020 and #3709 into one account-selection change: per-account proactive switch thresholds and optional return to a higher-priority account after fresh quota evidence shows it is eligible. Preserve the complete threshold contribution, including the GUI controls, translations, management API, CLI, atomic account-deletion intent and documentation.
The two original contributor-owned PRs remain open. This draft does not merge, deploy or change running account settings.
Verification
64b097c840f4f1f3cabf7048af32458b4acacc52, based on dev74490eee361d1c40f79c446fd532c5f2fc1463fd.3305154376d768a3db3fe6efea190754fbf154df: final policy file 27 passed, quota-prime file 27 passed, mounted account-controls cases 92 passed; types, production browser build, i18n, structure, privacy and ratchet checks passed. These are separate runs, not a full-suite total.96c7130, typecheck, structure and privacy passed again and the documentation build completed with 497 pages using the existing dependency tree.96c7130contribution merged with dev53654291and found two CLI fixture assertions: the fixture returned404 for the newly used accounts DTO.64b097csupplies that normal API response and adds a selected-account override regression without changing production error handling. The two relevant CLI files pass 6/0,20 assertions on pinned Bun1.4.0; typecheck, privacy and ratchet pass. This test-only follow-up leaves every prior production, UI and documentation file byte-identical.The headless render below uses the actual account-pool component and styles with synthetic inherited, fixed and disabled-threshold accounts. It makes no live API writes. DOM checks verify the control values and viewport bounds; the render is not a live-account acceptance test.
Checklist
Co-authored-by: Aleksei Chistiakov aleks00799@gmail.com
Co-authored-by: sbrusse-git sbrusse@gmail.com