Preserve Codex and XAI upstream message-too-big closes across the Responses WebSocket boundary while treating them as request-scoped errors. Prevent CPA reconnect and credential cooldown/fallback, scope close state to the active connection, retain terminal errors under backpressure, and ensure downstream disconnect cleanup cannot wait behind a blocked writer.
- Implemented logic to differentiate between generic and explicit model-not-found errors for the `count_tokens` endpoint.
- Introduced `recordAvailabilityNeutralResult` to ensure models remain active for generic endpoint errors.
- Expanded test coverage to verify behavior for various 404 scenarios, including error propagation and model suspension handling.
- Refactored error-parsing utilities to identify structured and nested model-not-found errors.
Closes: #4410
- Introduced per-connection active channel management for Codex and XAI websocket sessions.
- Enhanced session behavior to support clearing and reassigning active channels tied to specific connections.
- Added support for detecting and detaching stale connections upon session target changes.
- Refactored websocket message handling logic to ensure connection-specific channel consistency.
- Extended test coverage for websocket session behaviors, including reconnections, target switching, and pinned auth transitions.
- Introduced `display-name` field for human-readable model names in config and YAML files.
- Updated alias application logic to set and preserve display names during model alias mapping.
- Enhanced tests to validate display name behavior for various scenarios, including forks and upstream preservation.
- Refined `sanitizeOAuthModelAlias` to handle `display-name` with proper trimming and formatting.
Closes: #4398
- Introduced CPA trace ID middleware to inject trace IDs in response headers.
- Added support for CPA trace ID generation and validation.
- Updated metadata handling to include stable auth indices and trace ID callbacks for enhanced request tracking.
- Enhanced tests to verify CPA trace ID propagation and reserved header handling across middleware, metadata, and handlers.
Closes: #4370
- Introduced PluginSyncRequest and PluginSyncResponse types for managing plugin synchronization.
- Added validation logic for plugin sync responses, including checks for schema version and expiration.
- Implemented functionality to clear sensitive data from plugin sync requests and responses.
- Enhanced error handling for HTTP requests related to plugin synchronization.
- Updated manifest validation to reject artifact URLs containing credentials or query parameters.
- Added tests for plugin synchronization, ensuring proper validation and error handling.
- Refactored existing code to support resolved authentication configurations for plugin downloads.
- Enhanced response handling to support `response.incomplete` events across translator components and executors.
- Refactored `resultErrorFromError` to centralize error conversion and consolidate repeated logic for constructing custom errors.
- Updated handling of `max_output_tokens` and similar terminal reasons in OpenAI and Gemini translator workflows.
- Introduced `IsRequestScoped` and `IsRequestScopedError` to differentiate between request-scoped and non-request-scoped errors.
- Added comprehensive test cases for incomplete responses, terminal failures, and error propagation in both streaming and non-streaming conditions.
Closes: #3055
Propagate client generate metadata through usage records while keeping
legacy callers that omit the field enabled by default. Preserve an
existing context generate=false when metadata does not set the value,
and normalize omission to true only at publishing boundaries.
- Implemented `SelectAuthByKind` to filter and select credentials by kind with retry logic and error handling.
- Updated Codex Alpha Search to enforce OAuth credentials and sanitize upstream request body.
- Added unit tests to validate `SelectAuthByKind` behavior across scenarios.
- Introduced `sanitizeCodexAlphaSearchBody` for removing sensitive fields from API payloads.
Closes#4289
- Implemented `homeForceMappingAliasResult` for handling forced alias mapping in the authentication process.
- Updated `resolveExecutionAliasResultForRequested` to incorporate home force mapping.
- Introduced new attributes (`home_force_mapping` and `home_original_alias`) for managing alias behavior.
- Extended `homeAuthDispatchResponse` with fields for force mapping and original alias.
- Added test cases to validate force mapping logic and edge cases.
* fix(usage): preserve request service tier metadata
* fix(usage): collapse request tier metadata
* fix(usage): emit only service_tier and response_service_tier
Collapse request tier to service_tier for usage records and queue payloads. Keep RequestServiceTier as a deprecated input-only alias for older plugin callers.
- Introduced `xai-api-key` to configuration for supporting xAI provider integration.
- Added API key operations: creation, updates, deletion, and sanitization.
- Implemented backend enhancements for credential-specific routing, response filtering with model aliasing, and WebSocket handling for xAI services.
- Included extensive test coverage to validate configuration parsing, CRUD operations, and the new functionalities.
- Updated related modules to handle `xai-api-key`, including the watcher, management handlers, and configuration sanitizers.
Load codex_client_models.json like models.json with validation, revisioned
handler reloads, CI bake, and Home-aware updater gates so list IDs still
come from Home while templates can refresh on the edge.
- Added `DisplayName` to model configuration for Codex, Claude, Gemini, Vertex, and OpenAI compatibility.
- Updated hash computation and model summary to account for `DisplayName`.
- Enhanced API handlers to use `DisplayName` for client-facing catalogs.
- Expanded tests to verify `DisplayName` usage, preservation, and fallback mechanisms.
- Updated documentation and configuration examples for `DisplayName` field.
Closes: #4245
- Replaced `ExecuteWithAuthManager` with `ExecuteImageWithAuthManager`.
- Replaced `ExecuteStreamWithAuthManager` with `ExecuteImageStreamWithAuthManager` for improved clarity and specificity.
- Refactored websocket output collection to restore completed events using fallback items and indexed payloads.
- Updated `CodexExecutorCompact` tests to ensure no injection of `image_generation` tools and maintain compact input order.
- Added new tests to validate sustained reasoning, proper output restoration, and compaction replay behavior.
- Improved logic to handle incremental response appends and preserved reasoning continuations.
- Enhanced test coverage for normalization, tool calls, and downstream payload restoration scenarios.
Closes: #4176
- Replaced PKCE-based OAuth for xAI with device authorization flow for enhanced compatibility.
- Introduced cancelable OAuth sessions with server-side invalidation to prevent token persistence on flow interruption.
- Updated OAuth polling and session tracking to handle device flow specifics, such as `user_code` and extended timeouts.
- Refactored TUI OAuth model to track polling generations, distinguish device flow, and handle session cancellation gracefully.
- Extended test cases for device flow scenarios, stale session handling, and cancelation logic.
- Streamlined xAI device flow management in handler logic and improved error handling.
- Updated Codex client to validate and restrict input modalities to "text" and "image" only.
- Added deduplication logic for input modalities in `codex_client_models.go`.
- Introduced test cases to verify behavior with mixed and invalid modalities.
- Added `EnsureClaudeModelIDPrefix` and `ResolveClaudeModelIDPrefix` utilities for standardizing and decoding Claude model IDs.
- Updated handling of `claude-fable-5-dd-<reversed>` model IDs for request routing and response formatting.
- Incorporated logic to enforce disabled states for plugin virtual auths and their expanded children.
- Refactored code for applying and persisting disabled state metadata in plugin multi-auth scenarios.
- Implemented and extended unit tests to validate expected behavior.
- Added `tryRefreshAfterUnauthorized` to refresh OAuth credentials on 401 errors during requests.
- Implemented `refreshLocks` to prevent concurrent refreshes for the same auth ID.
- Updated auth/state handling to reset unauthorized model states and resume operations after a successful refresh.
- Enhanced refresh logic with error handling, synchronization, and state updates.
Closes: #4087
- Added handling of input/output modalities metadata for Codex and compatibility clients.
- Updated model registry and configurations to support "text" and "image" modalities.
- Introduced new tests to validate input/output modalities registration and processing.
Closes: #3976
- Added fallback and suspension handling for `invalid_grant` errors in auth conductor.
- Introduced helper methods to detect `invalid_grant` error patterns.
- Updated tests to validate `invalid_grant` fallback and suspension scenarios in execution and stream flows.
Closes: #4120
- Introduced API handlers and executor logic for Google Interactions
- Added request and response transformations for OpenAI and Claude Interactions.
- Integrated Gemini API with Interactions support.
- Updated tests to validate Interactions request parsing and error handling.
- Refactored translator logic for Interactions data flows.
shouldRetryAfterError approves a retry using the pre-jitter wait, so the jitter added in waitForCooldown could push the actual sleep up to 2s past the configured max-retry-interval ceiling. Clamp the jitter range to the remaining headroom below maxWait so the documented maximum stays a hard bound; waits at the ceiling simply sleep unjittered.
Previously every 429 incremented the backoff level unconditionally, so N concurrent in-flight failures from a single quota event inflated the level by N at once (12+ failures jump straight to the 30 minute plateau even when the upstream limit clears in seconds). Failures that land while a previous quota window is still open now reuse that window instead of escalating, so the ladder advances at most once per window. Provider supplied retry hints still take effect unchanged.
waitForCooldown also slept until the exact recovery deadline, waking every waiting request in lockstep against the single recovered credential and re-escalating it in one burst. Cooldown waits now carry a small random jitter (up to wait/4, capped at 2s) to spread the wakeups.
For downstream websocket with CPA-mediated HTTP/SSE upstream (non-passthrough),
always merge the full conversation transcript instead of sending incremental
previous_response_id turns. Release pinned websocket auths after timeout and
gateway failures, and after WS bootstrap failover pin the successful SSE
credential so the next turn keeps merged context instead of retrying a
suspended websocket auth.
Fixes#4048
Force-mapping rewrites streaming OpenAI Responses SSE through StreamRewriter before the /v1/responses websocket forwarder. Antigravity/Gemini and Codex emit frames without reliable trailing newlines, so buffered chunks glued as ...}event:..., ...}data:..., or event:/data: without separators. The rewriter dropped pending tails and downstream WS synthesized 408 without response.completed even when upstream returned HTTP 200.
- safeReplaceGlued for }event: and }data: when data JSON is complete\n- Finish flush with glue normalization and line-wise fallback\n- Newline between pending event: and next data: line (Codex scanner lines)\n- Regression tests: Antigravity sim, Codex data lines, force-map WS forward
- Added Manifest struct to encapsulate plugin metadata and installation details.
- Implemented ManifestFromRelease and ManifestFromPlugin functions for creating manifests from releases and plugins.
- Enhanced Plugin struct to include Versions and InstallPlan for direct installations.
- Introduced validation for direct install type, ensuring artifacts are correctly specified.
- Updated registry validation to support new schema version and direct install requirements.
- Added tests for parsing and validating direct install plugins, ensuring correct artifact handling.
* fix(oauth): force-map responses to config alias not request suffix
Rewrite client-visible model fields using oauth-model-alias Alias from config
(e.g. gpt-5.4-fast) instead of mirroring the requested model string when the
client adds thinking suffixes (e.g. gpt-5.4-fast(high)). Upstream routing
still preserves suffixes on the resolved upstream model.
* test(oauth): gate response rewrite on ForceMapping and document OriginalAlias
- Document that OriginalAlias is only applied when ForceMapping is true
- Set OriginalAlias to config alias only when force-mapping is enabled
- Add tests: no non-stream/stream payload rewrite when ForceMapping is false
* test(oauth): assert disabled force mapping response
Luis Pater