feat(usage): read connected hub usage scoped to the enrolled client key - #4373
Conversation
Co-authored-by: Cortes Ventures <admin@cortesventures.com>
Carry #3458 runtime foundations with explicit session grants, private state stores and fail-closed Windows command support. Keep server and dashboard activation for the dependent integration layer. Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com>
Co-authored-by: SB Yoon <44089734+yansigit@users.noreply.github.com>
Preserve ordered whole-token parts and input identity through one admitted recovery request. Detect split-token structure without authorizing reconstruction. Local tests NOT RUN by maintainer instruction; hosted CI follows.
Co-authored-by: Kosta Milovanovic <kosta963@gmail.com>
Carry #3458 dashboard and CLI wiring with explicit Hub opt-in, session-only mutations and awaited optional cleanup. Preserve current server and documentation owners; hosted preview and final cumulative CI remain pending. Co-authored-by: Ingwannu <ingwannu@users.noreply.github.com>
Expose a bounded GET /v1/usage projection for explicitly authenticated configured keys, reusing filtered aggregation and its incomplete-history metadata. Connected CLI reads the hub data plane with token/connection ownership checks, never local fallback or management credentials. Local tests NOT RUN; hosted CI follows.
|
Important Draft PR not reviewedDraft PRs are not automatically reviewed by default.
To automatically review draft PRs, update your CodeRabbit configuration: reviews:
auto_review:
drafts: trueThanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
|
✅ Deterministic PR hygiene checks passed. |
리뷰 · 우선순위 52 / 80이 PR은 connected 클라이언트의 서버 테스트가 CLI·client·server·attribution 쪽으로 꽤 있습니다. 설계상 “계정 합계를 클라이언트에 새지 않는다”는 점이 분명합니다. 다만 stacked base라서 지금 현재 경로 경로 range 파싱 - 쿼리에서 스택 - 부모 #4357이 메인테이너의 판단이 필요한 지점
너의 추천 이 댓글은 grok-bot이 작성했습니다 |
Share browser session readiness with the shell, explicitly refresh retained resources after pairing, distinguish authentication/permission/network/shape failures, and preserve labelled stale data only for non-auth failures. Show hub identity and current-origin pairing command with copy and cancellation feedback. Local suites NOT RUN; hosted build and rendered review follow.
Carry #4119 with current structured-output fields preserved, retained-byte accounting, and conditional-async MiMo delegation. Co-authored-by: DamnUi <damnui@users.noreply.github.com>
…age tip The parent branch gained an accounts quota stack while this lane was building, which left the PR conflicted against its own base, and GitHub will not dispatch a pull_request run it cannot build a merge commit for. Six conflicts, all additive with an empty merge base: the capability registry gained both entries (account history from the parent, account main reauth from this lane, ordered before account list), and the structure notes keep both sides. The skill surface map is regenerated from the merged registry.
…time foundation [skip ci]
…yer [skip ci] One conflict in the stop override, empty merge base on both sides: this lane sets remoteWorkspaceStopping so the later remote-workspace shutdown step sees it, and dev's audio lane clears liveCallBindings. They are independent synchronous teardown bookkeeping, so both run.
…age tip Eleven conflicts. The nine locale catalogs and the API-keys workspace imports were additive on both sides, so each keeps the union; rerere offered a cached resolution from another lane that silently dropped models.pickerOrder.label from all nine locales, so these were re-resolved from the recreated conflicts and key-set equality against both parents is now exact. api-key-attribution combines this lane's /v1/usage GET endpoint with dev's live-call FormData setup, which the body builder below already reads. The two Remote Workspace pointers this lane appended to structure/gui-and-management-api.md are folded into one paragraph: both sides appending pushed the file to 602 lines and structure:check budgets it at 600. No text or link is dropped.
…log tests Pre-open the voice/audio upstream before the client 101, reuse that socket on attach, and pass audio protocol/abort/finish fields through. Catalog launcher tests now read OPENCODEX_OPENCODE_API_KEY and do not require Bun to honor HTTP_PROXY. Dashboard sidecar optional chaining and the French Hub product name keep pairing tests green after the audio dashboard merge.
…k tip UI evidence for the gui/ paths this stack carries. Captured from a throwaway proxy instance on an isolated OPENCODEX_HOME with runtimeRole=hub and OCX_REMOTE_WORKSPACE_ENABLED=1; the pairing code shown is one-time, already expired, and belongs to that discarded instance.
Pairing tests seed dashboard sidecar vision/webSearch so the overview panels do not crash after session install. Catalog transport tests stop using a global fetch proxy probe and assert the spawn env object the launcher actually passes.
Fifteen structure/ conflicts. Fourteen were additive appends with an empty merge base, so both sides survive. openai-tiers had a real base: this lane inserts an Automatic pool plan exclusions heading where dev inserts a canonical forwarding note, and the base heading still follows below, so both land. Both sides appending pushed transports/responses.md and gui-and-management-api.md past the 600-line budget. Rather than take a grace exemption, this lane's own appended paragraphs are consolidated and re-wrapped to the long-line style the rest of these files already use. No sentence, fact or link is dropped.
…age tip The parent branch moved again, so the PR was dirty against its own base and GitHub will not dispatch a pull_request run it cannot build a merge commit for. All 24 conflicts resolve to this side, verified rather than assumed. Both sides already carry current dev, so the parent contributes nothing new here: the nine locale catalogs add no keys this branch lacks, and every structure/ paragraph and anchor the parent offers is already present. The parent's en.ts also ships two entries collapsed onto one physical line from an earlier resolution, which this side does not reproduce.
…context fix(opencode-go): publish DeepSeek V4.1 context window
React Doctor runs as a PR gate at blocking: warning and flagged three findings, all from the device-reauth work this stack carries. The hook parsed every reauth response before testing res.ok, so a failure body was consumed without a status check (react-doctor/no-fetch-response-used-without-status-check, twice). The status test now comes first and each branch reads the body it needs; the failure code still comes from the error payload, so behavior is unchanged. The test probe assigned the hook result to an outer binding during render, which react/react-compiler rejects. It publishes from an effect instead, and act() flushes effects, so every assertion still reads the latest committed value. All three tests in the file pass and React Doctor reports no issues.
fix: bound multipart encrypted agent task recovery
…oute Hosted CI failed on Linux and macOS with "the scanner resolves a method for every route guard it finds": management-api.ts matches /api/codex-auth/main/reauth-device (#3898) only to hand the request to its own module, so the dispatch site names no verb. The route is not undeclared. The handler module owns the POST/GET/DELETE dispatch and answers 405 for anything else, and the registry declares all three against that module. Narrowing the guard to a method list would have resolved the scan and changed behavior: an unsupported verb would fall through to the generic codex-auth dispatch and 404 instead of 405. Prefix delegations are already invisible to the scanner for the same reason, so this teaches it the equality-guard form, which is what the test comment asks for. The rule is deliberately narrow: only a block whose statements are exactly the dynamic import and the return of its handler. A block that does any work of its own stays unresolved and still fails loudly, and the new test drives that second probe red to prove the rule cannot swallow a real route.
dev advanced 52 commits while this lane was repairing its CI failures. Twenty-two conflicts. The docs-site guides, the server index imports and most structure/ notes were additive on both sides and keep both. Three structure files had a real base because this lane had re-wrapped shared paragraphs: dev's new listener-diagnostics and live-sideband notes land, and the re-wrapped copy of the shared text is kept rather than reverting to the wrapped original. dev now sits at 596 and 591 lines in the two docs this lane appends to, so both crossed the 600-line budget again. Reclaimed the difference from this lane's own paragraphs only, by re-wrapping them to the long-line style already dominant in these files and folding adjacent cross-reference pointers together. No sentence, fact or link is dropped, and no grace exemption is taken.
|
Maintainer integration record — trio-remote lane tip, merged by @lidge-jun. This pull request's base is The L1 to L3 order is the one recorded in
|
df3b88d
into
codex/260912-60plus-operations-totals
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
2 participants
Summary
Connected
ocx usagereads the hub data plane using the enrolled client key, instead of calling a missing local management endpoint. The hub returns only that authenticated key's numeric totals and provider/model/day rows; account attribution, raw entries and other clients' records are excluded.The bounded response retains range/surface/provider/model/custom-window options and explicit incomplete-history metadata. Invalid connections, changed token ownership, unsupported hubs and read failures are reported without local fallback. Addresses #4205.
Manual chain: #4357 (readable totals) → this PR (client-scoped read). Base is
codex/260912-60plus-operations-totals; this layer uses its aggregate metadata contract. No native stack is registered. Merge decisions belong to the parent coordination task.Verification
git diff --check: passed. Independent design and implementation-entry audits passed; independent security/source implementation review passed at3565b90 and the two-test follow-up bf369d9.Checklist
UI screenshots
This PR is the tip of a cumulative stack, so its diff carries the
gui/changes of every link below it. The substantive new surface is the Remote Workspace page from #4372.Captured from a throwaway proxy on an isolated
OPENCODEX_HOMEwithruntimeRole: "hub"andOCX_REMOTE_WORKSPACE_ENABLED=1, againstbun run build:guioutput at c9b73a4.Remote Workspace, hub enabled — new sidebar entry, pairing card, computer list, and the new-session form:
Pairing flow after Create pairing code, with the generated one-time code and the copyable Linux/macOS and PowerShell enrollment commands:
The pairing code shown is one-time, already expired, and belongs to that discarded temporary instance.
The main-card device Re-login CTA from #4441 is not captured: it renders only when the native main credential is actually expired, which needs a real expired ChatGPT credential rather than a fixture. Its rendering and flow are covered by
gui/tests/main-device-reauth.test.tsxandtests/gui/main-device-reauth-ui.test.ts.