- Add Handler.configSnapshot to read h.cfg under h.mu for OAuth login handlers and background callback waiters that outlive the request.
- Use configSnapshot in Claude, Codex, and Antigravity OAuth login handlers as well as token persistence helpers to prevent data races with config saves.
Closes: #6871
- Re-run AccessManager authentication before each responses websocket turn and duplex continuation using a cloned POST request with handshake headers stripped.
- Add AuthErrorCodeDenied and NewDeniedError in sdk/access so terminal provider refusals preserve their HTTP status and stop the provider chain.
- Add DenyStatusCode and DenyMessage to pluginapi.FrontendAuthResponse and map explicit plugin denials in accessAdapter.Authenticate.
Closes: #6843
- Select the original OAuth partition for ChatGPT Alpha Search without changing SIWC Responses behavior.
- Reject missing original OAuth tokens before sending and preserve existing API-key and custom-header behavior.
- Add real-executor transport and API regression coverage for credential partition isolation.
Closes: #6830
- Persist the real SIWC token expiration time from expires_in and evaluate local SIWC status using real expiration (or JWT exp) and upstream 401 rejection state without triggering network requests.
- Track SIWC token rejections independently from outer Codex OAuth refreshes, execution retries, and use_siwc toggles until the SIWC token is replaced.
- Expose the read-only v8 management SIWC status endpoint and summary field for Codex credentials.
Closes: #6819
- Acquire the Codex file lock around in-place disk writes in writeAuthFile when writing or replacing Codex credentials, and resolve symlinked paths in canonicalLockPath so upload and bind paths share the same lock.
- Verify in BindCodexSIWC before atomic replacement that the backing file bytes on disk still match the initial read, preventing uncooperative in-place rewrites from being silently overwritten.
- Add regression tests covering in-place rewrites during SIWC bind commits and legacy uploads contending on the Codex file lock.
Closes: #6811
- Record the target credential's start-time account ID in the SIWC bind session and validate disk consistency before starting authorization.
- Require BindCodexSIWC to match the start-time account against both the live in-memory credential and the backing file before persisting SIWC tokens.
- Add unit and management handler regression tests covering account replacement via legacy uploads and watcher updates during active SIWC binds.
Closes: #6809
- Resolve relative path and source attributes against the current working directory in codexBindingPath instead of re-joining them with auth-dir, keeping the auth-dir join only for bare FileName fallbacks.
- Normalize relative auth-dir and credential paths to absolute paths before symlink evaluation in codexBindingPath and resolveSIWCBindFile so confinement checks remain consistent when working directory ancestors contain symlinks.
Closes: #6805
Reject any home models payload containing an error key before
parsing provider sections. Array-shaped error values were
previously treated as model sections, masking upstream errors
as valid or empty catalogs instead of returning an error.
Return an empty catalog when home returns no model records, e.g.
when the client's access scopes have no routes, instead of erroring.
Still reject null payloads, null sections, and non-empty sections
with no usable model IDs as malformed.
- Implement fallback logic in model definitions handler to query plugin host and global registry for unknown channels.
- Add sorting for registry model definitions by provider and ID to ensure consistent responses.
Closes: #6736
- Implement `Modify` method on auth manager to load, clone, edit, and commit records atomically under a per-auth mutation lock.
- Refactor auth field patches and status updates to use the new `Modify` API, preventing race conditions and lost concurrent updates.
- Add comprehensive test coverage verifying concurrent patch operations, token refreshes, removals, and epoch checks.
Closes: #6733
Stop clearing existing excluded_models attributes in
ApplyAuthExcludedModelsMeta so plugin-provided rules survive
when an auth file defines none; callers rebuilding attributes
must drop stale values first, as PatchAuthFileFields now does.
Also reject config-sourced credentials in PatchAuthFileFields
with 404 and require excluded_models to be a string array or
null, rejecting legacy comma-separated string forms.
Keep existing credentials loading when excluded_models is invalid
instead of dropping them, warning and retaining only valid string
entries. Reject invalid rules at write entry points instead: auth
file uploads now validate before persisting and return 400, and
PATCH validates via the same extractor, accepting the legacy
comma-separated string form and persisting it as a canonical array.
Add regression coverage that a fence-dropped model registration is
replaced by applyConfigRuntime re-registration in Home mode.
- Simplified the ApplyAuthExcludedModelsMeta function to focus solely on credential-specific exclusions, removing unnecessary configuration dependencies.
- Updated tests to reflect changes in the exclusion handling logic, ensuring that credential-level exclusions take precedence over global configurations.
- Removed the metadata_exports.go file as it was no longer needed.
- Enhanced model registration logic to maintain global exclusion summaries and prevent obsolete configurations from affecting new registrations.
- Introduced new tests to verify that global exclusions are retained after authentication updates and that irrelevant config reloads do not discard valid registrations.
- Improved the handling of plugin model providers to ensure that exclusion rules are correctly applied and updated.
- Implement ETag generation using SHA-256 source hashes on v8 management config reads.
- Enforce RFC 9110 If-Match validation on mutating requests to prevent stale overwrites.
- Expose ETag headers for CORS and mask sensitive `value` query parameters in request logs.
Closes: #6666
- Add `SourceHash` tracking to config parsing to identify stale config file reloads.
- Reject reloads in management handlers and watchers if they are based on an older file snapshot.
- Serialize concurrent config reloads and secure lock handling in basic/list management endpoints.
Closes: #6631
- Access configuration safely via getters across server routes, middleware, and service routines.
- Clone configuration snapshots for runtime and synchronize access in management handlers.
- Guard configuration YAML snapshots with mutex locks during reloads.
Closes: #6592
- Access configuration safely via getters across server routes, middleware, and service routines.
- Clone configuration snapshots for runtime and synchronize access in management handlers.
- Guard configuration YAML snapshots with mutex locks during reloads.
Closes: #6559
Expose quota_plugin_id on credential entries using the host's two-pass selection precedence, excluding fused plugins and selecting healthy alternatives.
Stop advertising declarative quota_probe support in v8 while preserving v0 behavior. Add regression tests for selection precedence, plugin fusion, and version-specific quota metadata.
Fixes#6519
Enable deferred filtering only when the client tool_search declaration
wins the tool_search name, so a same-named user function keeps the
deferred tools. Pass Home catalog provider routes to the search
capability check so Claude-only Home models advertise tool search.
- Inject API key, access provider, and native key flags into the request context during authentication
- Add `IsNativeKey` and `AccessProvider` fields to usage records, plugin API types, and redis queue payloads
- Provide context helper functions and automatic fallback resolution in the usage manager and reporter
Closes: #6509
- Add `FlushResponse` to prefer error-aware flushing and unwrap wrapped response writers
- Bypass Gin's void `Flush` while maintaining header accounting via `WriteHeaderNow` to keep transport errors observable
Closes: #6332
- Synthesize and populate live `auth_index` attributes into V8 `api-keys` responses
- Strip transient `auth_index` and `auth-index` fields from incoming update payloads and root nodes before persistence
- Ensure `auth_index` keys are omitted during V8 config transformations
Closes: #6287
- Retain `freeform` apply_patch tool type for native template models when `enable-apply-patch` is false
- Update client configuration documentation for `client.codex.enable-apply-patch`
Closes: #6286
Accept historical v8 config paths and request bodies while saving the
latest canonical layout. Preserve comments on scalar updates and keep v0
saves from migrating legacy-only files unnecessarily.
Move shared Codex, Claude, and xAI provider options under upstream so
they apply consistently to OAuth and API-key credentials. Migrate
historical OAuth paths, preserve OAuth-only header scope, and expose the
new upstream management API path.
- Handle apply_patch custom tool call streaming deltas and snapshots for Responses API translation
- Track and resolve step indexes, function call identities, and error states across stream events
- Propagate apply_patch tool input errors and upstream failure states in stream and non-stream responses
- Add `oauth-settings` configuration to override model capabilities such as `max-context-length`
- Implement sanitization, YAML preservation, and live reload diff detection for OAuth settings
- Apply OAuth model settings during model resolution and Codex model list responses
Closes: #6099
- Generate UUIDv7 request IDs using crypto random source
- Add `ShortRequestID` helper to truncate IDs to 8 trailing characters in log output and filenames
- Update management log handlers to match log files using short request IDs
- Extract `plan_type` from JWT claims and default missing values to `free`
- Include `plan_type` in token data, token storage, auth attributes, and file synthesis
- Ensure `plan_type` is maintained across token refresh flows
- Preserve empty map allocations during auth object cloning
- Retain obsolete and unknown root sections as comments instead of dropping them during v8 migration
- Defer removal of deprecated legacy blocks so they can be preserved as comments during layout normalization
