- Add `oauth-settings` configuration to override model capabilities such as `max-context-length`
- Implement sanitization, YAML preservation, and live reload diff detection for OAuth settings
- Apply OAuth model settings during model resolution and Codex model list responses
Closes: #6099
- Generate UUIDv7 request IDs using crypto random source
- Add `ShortRequestID` helper to truncate IDs to 8 trailing characters in log output and filenames
- Update management log handlers to match log files using short request IDs
- Extract `plan_type` from JWT claims and default missing values to `free`
- Include `plan_type` in token data, token storage, auth attributes, and file synthesis
- Ensure `plan_type` is maintained across token refresh flows
- Preserve empty map allocations during auth object cloning
- Retain obsolete and unknown root sections as comments instead of dropping them during v8 migration
- Defer removal of deprecated legacy blocks so they can be preserved as comments during layout normalization
- Attach resolved execution model info during execution and token counting even when restoring execution models
- Propagate configuration update support to resolved Home dispatch model info
- Track modifications to configuration updates across plugin normalizers in the translation pipeline
- Mark configuration update support for eligible Codex models in the registry
- Merge existing auth attributes and preserve file path metadata across plugin refreshes
- Avoid overwriting existing source and path attributes during auth data conversion
- Retry file stat during atomic replace to prevent premature removal of known auth files
Closes: #6119
- Fix malformed `X-Client-Id` header and ensure it is applied to upstream requests
- Preserve subscription metadata during OAuth token creation and token refreshes
- Support dynamic retry-after for 404 responses and shorten default Meta 404 cooldown
Closes: #6117
- Switch HTTP server stop from graceful shutdown to immediate close to prevent hanging on active requests
- Guard listeners and configuration access with dedicated mutexes
- Instantiate service shutdown context with a fresh timeout deadline upon exit
Closes: #6094
- Introduce `AttributeFilePriority` and helper to track priority inherited from auth files
- Preserve file-configured priority attributes and metadata in plugin host during auth refresh
- Apply file priority metadata consistently across synthesizer, token filestore, and management handlers
Closes: #6089
- Switch request ID generation to an atomic incrementing 8-character hex counter
- Create unique log files with numeric sequence fallback to prevent overwriting existing logs
- Select the latest log file matching request ID based on modification time and filename sequence in management API
- Marshal Codex client catalog as compact single-line JSON without HTML escaping
- Use compact base instructions for non-template models to stay within the 1MiB payload limit
- Keep `apply_patch_tool_type`, `upgrade`, and `availability_nux` present as null instead of deleting them
- Add `trusted-proxies` configuration option with IP and CIDR validation
- Apply trusted proxies to Gin engine to properly resolve forwarded client IPs
- Record `ResolvedClientIP` in request metadata and usage queue details
Closes: #6024
- Allow patching `priority` field for Gemini, Interactions, OpenAI compatibility, Vertex, and Codex credentials
- Update configuration entries with new priority value when present in patch payload
Closes: #6039
- Implement `streamCodexDuplex` to handle bidirectional WebSocket interactions for Codex
- Support steering continuations (`response.steer`) and queued creations (`response.create`, `response.append`)
- Preserve response settings and state transitions across steering updates and automatic successors
- Isolate connection-level failures with `codexDuplexConnectionError` to prevent unnecessary credential cooldowns
Closes: #5968
- Allow updating `priority` on Claude keys via the management PATCH endpoint
- Preserve existing priority values when omitted from the patch payload
Closes: #5967
- Reconcile expired credential and model cooldown states when building auth file entries
- Preserve error status and unavailability for persistent auth or token expiration failures
- Clear expired retry deadlines and restore active availability when cooldowns elapse
Closes: #5964
- Add tests for Claude cloak YAML persistence, comment preservation, and pruning of false/empty fields
- Cover partial PATCH and PUT updates, switch toggling, and credential identity isolation for Claude keys
Closes: #5935
- Detect Devin models by ID prefix, type, ownership, model registry metadata, or provider.
- Append `(Devin)` to model display names in Codex client responses when not already present.
- Set model `type` to `devin` in home Codex model formatting when served by the Devin provider.
- Return an error when the `$TOKEN$` placeholder cannot be resolved or the credential for `auth_index` is missing.
- Ensure `$TOKEN$` substitutions in headers and request payloads fail fast instead of proceeding with empty values.
- Support resolving and refreshing provider OAuth tokens for API calls.
Closes: #5838
- Add tests to verify that runtime hooks, auth modifications, and related updates do not block on unrelated operations such as antigravity probes or plugin virtual models.
- Introduce detailed scenarios, e.g., stale disables, batch operations, and conflict handling during concurrent auth updates.
- Refactor locking mechanisms to avoid unnecessary blocking during hooks and model registrations.
Fixed: #5813Closes: #5773
- Add example payload filter rules in `config.example.yaml` for stripping tools from both flat and nested `additional_tools` Codex request payloads.
Closes: #5792
