diff --git a/desktop/src-tauri/Cargo.lock b/desktop/src-tauri/Cargo.lock index 92ee4e1fbd9..8f416f48dc5 100644 --- a/desktop/src-tauri/Cargo.lock +++ b/desktop/src-tauri/Cargo.lock @@ -2645,7 +2645,7 @@ dependencies = [ [[package]] name = "opencodex-desktop" -version = "2.95.0" +version = "2.96.0" dependencies = [ "base64 0.22.1", "dbus", diff --git a/desktop/src-tauri/Cargo.toml b/desktop/src-tauri/Cargo.toml index 9407ec769d7..385e89c5464 100644 --- a/desktop/src-tauri/Cargo.toml +++ b/desktop/src-tauri/Cargo.toml @@ -1,6 +1,6 @@ [package] name = "opencodex-desktop" -version = "2.95.0" +version = "2.96.0" description = "OpenCodex desktop shell" authors = ["OpenCodex contributors"] license = "MIT" diff --git a/desktop/src-tauri/tauri.conf.json b/desktop/src-tauri/tauri.conf.json index d5c8dfbe104..38ac6967560 100644 --- a/desktop/src-tauri/tauri.conf.json +++ b/desktop/src-tauri/tauri.conf.json @@ -1,7 +1,7 @@ { "$schema": "https://schema.tauri.app/config/2", "productName": "OpenCodex", - "version": "2.95.0", + "version": "2.96.0", "identifier": "com.opencodex.desktop", "build": { "frontendDist": "../ui", diff --git a/docs-site/src/content/docs/guides/claude-code.md b/docs-site/src/content/docs/guides/claude-code.md index c0b83efa0ce..46687ed3468 100644 --- a/docs-site/src/content/docs/guides/claude-code.md +++ b/docs-site/src/content/docs/guides/claude-code.md @@ -69,6 +69,14 @@ response headers on streaming, JSON and upstream-error responses, so compatible statusLine consumers can read the provider's quota observations. Missing observations are not filled with invented values. This relay does not change account selection or retry behavior. +Usage reads support Ultra (formerly Max 20x). Pro and Max 5x retain their five-hour and weekly meters. A null five-hour limit leaves that meter +absent and still allows weekly usage to display. Current `limits` counters take precedence +over legacy duplicates; only active model-specific weekly limits affect that model family. +The dashboard shows Pro, Max 5x, or Ultra beside Claude account quotas, using subscription +metadata from the authenticated profile. Both `ultra` and `claude_max_20x` display as Ultra +(the existing `ultra` and `max_20x` tier aliases are retained). Unfamiliar validated tiers retain their original name without +failing the usage read. Claude account rows use ordinal labels and omit account IDs and emails. + You can log in multiple Claude accounts via the Providers dashboard (`ocx login anthropic` / add-account). By default every request uses the **active** account only. diff --git a/docs-site/src/content/docs/guides/codex-integration.md b/docs-site/src/content/docs/guides/codex-integration.md index 4eb3e800e34..ee6d1f4bb91 100644 --- a/docs-site/src/content/docs/guides/codex-integration.md +++ b/docs-site/src/content/docs/guides/codex-integration.md @@ -26,6 +26,16 @@ plus `openai-apikey/` for the configured API key. Pool includes main plus Direct uses only the caller/main bearer. The routes do not fall back to one another. Shipped v1 configs migrate to marker 2 and preserve `config.json.pre-openai-tiers-v2.bak` for manual restore. +When Pool selects an added account, OpenCodex replaces installation identifiers already present in +the request headers or client metadata with a stable identifier for that account and OpenCodex home. +Token refresh keeps the identifier; switching accounts changes it. Direct mode and the native main +account keep your original values. Missing installation metadata stays absent. OpenCodex does not +change Codex's own `installation_id` file when switching native profiles. If the local installation +secret cannot be read safely, the request returns a retryable 503 before reaching ChatGPT. +The same isolation covers authenticated live call sessions and subsequent realtime/sideband +WebSocket frames. Pool turn metadata above 32 KiB is refused before sending (503 for HTTP, +connection closure for WebSocket frames); Direct and native main values remain unchanged. + Within Pool mode, a request carrying a validated native Codex login can use that login when the selected stored account is cooling down and no eligible stored alternative or recovery probe is available. This also covers a new request blocked before sending, following the same caller diff --git a/docs-site/src/content/docs/guides/combos.md b/docs-site/src/content/docs/guides/combos.md index a0b9de7c718..91ffeb34b0d 100644 --- a/docs-site/src/content/docs/guides/combos.md +++ b/docs-site/src/content/docs/guides/combos.md @@ -154,7 +154,10 @@ native routing and catalog identity on the next sync. For Responses requests that require a tool, Meta Responses targets are skipped before sending because Meta does not support mandatory `tool_choice`. An eligible later target receives the -original choice. If every target is incompatible for this reason, the combo reports the constraint. +original choice, subject to its existing adapter compatibility rules. This includes hosted choices +such as `web_search`, `tool_search`, `computer_use` and `image_gen`, and MCP choices with a +nonempty `server_label` and an omitted, null or nonempty name, including inside required allowed-tools lists. Chat translation preserves a forced `tool_search` as the synthetic function choice. If every target is incompatible for this reason, +the combo reports the constraint. Chat targets that cannot preserve a mandatory selector, including models configured for auto-only tool choice, are also skipped before sending. Registered OpenAI API virtual models use the actual wire model's adapter and tool-choice policy for this decision. Malformed or unknown choices retain the provider's ordinary error path. `failover` selects the first eligible target in configuration order. A target is eligible when its provider exists, is enabled, is not cooling down, and can handle any special request constraint. diff --git a/docs-site/src/content/docs/guides/integrations.md b/docs-site/src/content/docs/guides/integrations.md index ae6a4775100..3d427ac444a 100644 --- a/docs-site/src/content/docs/guides/integrations.md +++ b/docs-site/src/content/docs/guides/integrations.md @@ -1036,6 +1036,11 @@ ocx agent roles suggest ocx agent roles suggest --model xai/grok-4.5 --apply ``` +The CLI's `--apply` accepts up to 50 changed roles in one history batch. A larger operation is +refused before any role update; preview it and apply individual choices with `ocx agent roles set`. +An interrupted operation reports confirmed writes and the unconfirmed request, and leaves earlier +writes applied. See the [CLI apply and recovery contract](/reference/cli/agents/) before retrying. + Under the table, **Change history** lists the newest changes a save, an auto-assign apply or `ocx agent roles set` wrote, newest first, in whole batches and never more than 50, so an Apply all is listed with every role it wrote or not at all, with each role's model and effort before and after. One Apply all is one entry. **Restore** writes the earlier values back through the same save, so a restore is listed too. A save never removes a model pin, so a role that had none keeps its current model and gets only its effort back. The history lives in `integrations/codex-agent-roles.jsonl` under the opencodex config directory, which retains at most 256 KiB and 1000 rows by dropping its oldest whole batches. Compaction targets 128 KiB and preserves a Restore together with its complete source batch when they fit both limits, making room by dropping unrelated older batches; history can still expire as later writes arrive. The writer captures the bounded history before appending so a Restore does not evict its own source at the retention boundary; the omo card's Restore center above tracks only `~/.omo/agent/models.json`. Each change records the Codex home it was made in, and only the current home's changes are listed or restored, so after pointing `CODEX_HOME` elsewhere the list starts empty and a Restore from another home's history is refused. If the history file cannot be read, the section says so in place of the list, and the role table keeps working. ## Kilo diff --git a/docs-site/src/content/docs/guides/providers.md b/docs-site/src/content/docs/guides/providers.md index 5a43f759fe2..ebd12465265 100644 --- a/docs-site/src/content/docs/guides/providers.md +++ b/docs-site/src/content/docs/guides/providers.md @@ -1450,7 +1450,7 @@ OpenCodex provides official adapter support for Qoder through the `qoder` (Globa - **Token usage:** Qoder CLI reports zero token counts unless its usage switch is on, so each preset turns it on in its scoped CLI child environment: `QODER_EXPOSE_TOKEN_USAGE=true` for Global and `QODERCN_EXPOSE_TOKEN_USAGE=true` for CN, which reads only its own prefix. - **Tool Ownership:** The CLI runs single-turn `stream-json` with `--tools ""`, `--strict-mcp-config`, setting sources disabled, and session persistence disabled, so Codex keeps exclusive tool ownership. Client-declared tools are exposed through an isolated request-scoped MCP server. - **Output guard:** If the CLI echoes OpenCodex tool-call/result replay envelopes into assistant text, the turn fails with `vendor_scaffold_detected` (502) instead of returning the envelope as a successful answer, and neither reasoning nor tool calls following the envelope are forwarded. Reasoning starts a fresh replay-text block, so earlier prose or code fences cannot hide an envelope in later text. If the CLI's turn already ended with its own error, that error is reported instead, still without the envelope. The proxy does not retry that failure automatically. Ordinary prose and closed fenced examples follow the shared envelope recognizer; an unverified overflowing fenced example is refused. Assistant text preserves Unicode characters split across CLI frames; unpaired surrogates are replaced with U+FFFD. -- **Image Input:** Global continues forwarding supported images through the shared projection without a per-model vision allowlist. CN retains its vision-sidecar defaults. Its raw-image route admits only one canonical base64 PNG of at most 1 MiB decoded in a single user turn with `DeepSeek-Flash` or `Qwen3.8-Flash`. Use `qoderclicn 1.1.70`: [issue #7516](https://github.com/lidge-jun/opencodex/issues/7516) reports Windows 11 x64 live success for those models on both `--attachment` and inline `--input-format stream-json --output-format stream-json` stdin; OpenCodex uses only stdin. The adapter validates base64 length/padding, decoded PNG signature and basic IHDR fields before CLI discovery; it does not decompress pixels or validate every PNG chunk/CRC. The 1 MiB ceiling is an OpenCodex resource policy, not a verified vendor maximum: the reported live evidence covers a 96×96 PNG, whose RGBA raster is only 36 KiB. Larger inputs require separate verification. Other CLI versions have not been verified, and the adapter does not probe the installed version. CN refuses raw URL images, other image formats/models, multiple images, tool-result images and image-bearing history/multi-turn replay before starting the CLI with `unsupported_input_modality`; use the vision sidecar for those inputs. Injected CLI tests cover serialization and cancellation without claiming live upstream support. Qoder's supported projection keeps image blocks in conversation order and marks unsupported references as `[image omitted: unsupported reference]`. Global stateless replay can still associate historical images unreliably with their original text; CN does not enable that unverified replay surface. +- **Image Input:** Global continues forwarding supported images through the shared projection without a per-model vision allowlist. CN retains its vision-sidecar defaults. Its raw-image route admits only one canonical base64 PNG of at most 1 MiB decoded, 8192 pixels per edge, and 16 million total pixels in a single user turn with `DeepSeek-Flash` or `Qwen3.8-Flash`. Use `qoderclicn 1.1.70`: [issue #7516](https://github.com/lidge-jun/opencodex/issues/7516) reports Windows 11 x64 live success for those models on both `--attachment` and inline `--input-format stream-json --output-format stream-json` stdin; OpenCodex uses only stdin. The adapter validates base64 length/padding, decoded PNG signature and basic IHDR fields before CLI discovery; it does not decompress pixels or validate every PNG chunk/CRC. These ceilings are OpenCodex resource policy, not verified vendor maxima: the reported live evidence covers a 96×96 PNG, whose RGBA raster is only 36 KiB. Larger inputs require separate verification. Other CLI versions have not been verified, and the adapter does not probe the installed version. CN refuses raw URL images, other image formats/models, multiple images, tool-result images and image-bearing history/multi-turn replay before starting the CLI with `unsupported_input_modality`; use the vision sidecar for those inputs. Injected CLI tests cover serialization and cancellation without claiming live upstream support. Qoder's supported projection keeps image blocks in conversation order and marks unsupported references as `[image omitted: unsupported reference]`. Global stateless replay can still associate historical images unreliably with their original text; CN does not enable that unverified replay surface. - **PAT recovery:** For both Qoder presets, a multi-key API-key pool can switch to another PAT on a supported authentication rejection or account-level quota exhaustion, but only before response content or an event that makes replay unsafe. Recovery requires Qoder-specific classification and respects credential-hop and send budgets; an HTTP 401/429 or quota message alone is not permission to replay. Single-key configurations do not rotate. Sharing the CLI runner does not enable this API-key recovery for CodeBuddy or self-authenticated Claude CLI. - **Quota:** No public quota API is used, so totals and reset times are unavailable. Codes 110 (account daily limit) and 118 (personal Credits exhaustion) report `insufficient_quota` and permit consideration of PAT recovery. Other supported quota codes also report `insufficient_quota` but do not authorize it. Numeric error codes take precedence: an unrecognized numeric code does not fall back to quota or authentication text. Without a numeric code, only the supported account-daily message beginning “You've reached your daily usage limit for Chat”, with no team/model/shared qualifier, grants quota recovery; generic credit-limit text does not. Only quota failures eligible for PAT recovery enter key cooldown handling. When such a failure has no reset time, the failed key uses the existing default cooldown; nonrecoverable quota classifications do not create a cooldown through this path, and no next-day reset is inferred. - **Operators:** Qoder Global is operated by BRIGHT ZENITH PRIVATE LIMITED under the [product service terms](https://qoder.com/product-service); Qoder CN by 通义云启（杭州）信息技术有限公司 with Alibaba Cloud. Verify `ocx provider test qoder` (or `qoder-cn`) after configuring. diff --git a/docs-site/src/content/docs/ja/guides/combos.md b/docs-site/src/content/docs/ja/guides/combos.md index 943ccef2bc0..9823756979f 100644 --- a/docs-site/src/content/docs/ja/guides/combos.md +++ b/docs-site/src/content/docs/ja/guides/combos.md @@ -64,6 +64,8 @@ ocx combo show main ## 戦略を選択してください +必須の `tool_choice` を維持できないターゲットは送信前にスキップされ、すべて非対応の場合はその制約を示すエラーを返します。自動選択のみを許可する Chat モデルと、OpenAI 仮想モデルの実際の送信モデルのポリシーも判定対象です。直接の hosted/MCP 選択、`tool_search`、無効な選択値の扱いは[英語の基準説明](/guides/combos/#failover-ordered-primary-and-backups)を参照してください。 + ### フェイルオーバー: 順序付けされたプライマリとバックアップ `failover` は、構成順序で最初の適格なターゲットを選択します。ターゲットは、プロバイダーが存在し、有効になっていて、クールダウン中でなく、特別なリクエスト制約を処理できる場合に適格となります。重みと `stickyLimit` はこの戦略に影響しません。 diff --git a/docs-site/src/content/docs/ja/guides/integrations.md b/docs-site/src/content/docs/ja/guides/integrations.md index 78a542c29b8..e34ff7db555 100644 --- a/docs-site/src/content/docs/ja/guides/integrations.md +++ b/docs-site/src/content/docs/ja/guides/integrations.md @@ -245,6 +245,8 @@ LazyCodex が検出されると、omo タブの **omo (Codex / LazyCodex)** セ **自動割り当て** は、必要な能力と推論負荷を評価したロールのうち、選んだモデルの推論負荷の段階リストが空でないすべてのロールに推論負荷を提案します。**適用**、**すべて適用**、または `ocx agent roles suggest --apply` は、そのロールの `model_reasoning_effort` を追加または置き換えます。推論負荷は選んだモデル自身の段階から、最も低い段階、既定の段階、既定より 1 つ上の段階、最も高い段階のいずれかになります。段階リストが空なら推論負荷を提案せず（`proposedEffort: null`）、適用時は `effort` を送らないため既存の固定値はそのまま残ります。`null` の提案が固定値を消すことはありません。 +CLI の `ocx agent roles suggest --apply` は、1 つの履歴バッチで最大 **50 件の変更対象ロール**を適用します。設定が既に一致するロール、評価されていないロール、割当先のないロールは数えません。50 件を超える場合は、ロールの更新を一件も送信せず終了コード 5 で拒否します。`--apply` なしでプレビューし、個別の変更には `ocx agent roles set [--effort ]` を使ってください。途中で失敗した場合の確認済み・未確認の更新と再試行の注意点は、[CLI の適用と復旧の契約](/reference/cli/agents/)を参照してください。 + ## Kilo Kilo CLI、VS Code、JetBrains は同じグローバル設定を共有します。この統合は `~/.config/kilo` 内の `kilo.jsonc`、`kilo.json`、`opencode.jsonc`、`opencode.json`、`config.json` のうち最初に存在するファイルに `provider.opencodex` を書き込みます。`XDG_CONFIG_HOME` でこのディレクトリを変更できます。候補がなければ `kilo.jsonc` を作成します。プロジェクト設定には書き込みません。 diff --git a/docs-site/src/content/docs/ko/guides/combos.md b/docs-site/src/content/docs/ko/guides/combos.md index 40ad3327e05..b81448df36b 100644 --- a/docs-site/src/content/docs/ko/guides/combos.md +++ b/docs-site/src/content/docs/ko/guides/combos.md @@ -70,6 +70,8 @@ alias는 클라이언트가 요청하는 공개 이름만 바꿉니다. 콤보 ## 전략 선택 +필수 `tool_choice`를 보존할 수 없는 대상은 전송 전에 건너뛰며, 모든 대상이 호환되지 않으면 해당 제약을 오류로 반환합니다. 자동 선택만 허용하는 Chat 모델과 OpenAI 가상 모델의 실제 전송 모델 정책도 이 판단에 반영됩니다. 직접 hosted/MCP 선택, `tool_search`, 잘못된 선택값의 처리 범위는 [영문 기준 설명](/guides/combos/#failover-ordered-primary-and-backups)을 참고하세요. + ### 페일오버: 순서가 있는 기본값과 예비값 `failover`는 설정 순서에서 가장 먼저 적합한 대상을 선택합니다. 대상이 적합하려면 해당 공급자가 존재하고, 활성화되어 있고, 쿨다운 중이 아니며, 요청에 붙은 특수 조건을 처리할 수 있어야 합니다. 이 전략에서는 가중치와 `stickyLimit`이 영향을 주지 않습니다. diff --git a/docs-site/src/content/docs/ko/guides/integrations.md b/docs-site/src/content/docs/ko/guides/integrations.md index ba1a77a7ea9..db7efc81b07 100644 --- a/docs-site/src/content/docs/ko/guides/integrations.md +++ b/docs-site/src/content/docs/ko/guides/integrations.md @@ -255,6 +255,8 @@ LazyCodex가 감지되면 omo 탭의 **omo (Codex / LazyCodex)** 섹션에서 `$ **자동 배정**은 필요한 능력과 추론 강도를 판정한 역할 가운데 선택된 모델의 강도 단계 목록이 비어 있지 않은 모든 역할에 추론 강도를 제안하며, **적용**, **모두 적용** 또는 `ocx agent roles suggest --apply`는 그 역할의 `model_reasoning_effort` 값을 추가하거나 바꿉니다. 강도는 선택된 모델 자체의 단계에서 정하며, 가장 낮은 단계, 기본 단계, 기본보다 한 단계 높은 단계, 가장 높은 단계 중 하나입니다. 단계 목록이 비어 있으면 강도를 제안하지 않고(`proposedEffort: null`), 적용할 때 `effort`를 보내지 않아 기존 강도 고정을 그대로 둡니다. `null` 제안은 고정값을 지우지 않습니다. +CLI의 `ocx agent roles suggest --apply`는 한 이력 묶음에 **변경할 역할을 최대 50개** 적용합니다. 이미 같은 값으로 설정됐거나 평가·배정되지 않은 역할은 세지 않습니다. 50개를 넘으면 역할 업데이트를 하나도 보내지 않고 종료 코드 5로 거부합니다. `--apply` 없이 미리 확인한 뒤, 개별 변경에는 `ocx agent roles set [--effort ]`을 사용하세요. 도중에 실패했을 때 확인된 쓰기와 미확인 요청을 구분하고 재시도하는 방법은 [CLI 적용·복구 규칙](/reference/cli/agents/)을 참고하세요. + ## Kilo Kilo CLI, VS Code, JetBrains는 전역 설정을 공유합니다. 이 연동은 `~/.config/kilo` 아래의 `kilo.jsonc`, `kilo.json`, `opencode.jsonc`, `opencode.json`, `config.json` 중 먼저 존재하는 파일에 `provider.opencodex`를 씁니다. `XDG_CONFIG_HOME`로 이 디렉터리를 옮길 수 있습니다. 후보 파일이 없으면 `kilo.jsonc`를 만듭니다. 프로젝트 설정은 수정하지 않습니다. diff --git a/docs-site/src/content/docs/reference/cli/agents.md b/docs-site/src/content/docs/reference/cli/agents.md index bce042afced..11b7f0269cf 100644 --- a/docs-site/src/content/docs/reference/cli/agents.md +++ b/docs-site/src/content/docs/reference/cli/agents.md @@ -34,6 +34,23 @@ prints a proposed model and effort per role without writing anything. `--apply` through the same write as `set`, skipping and naming the roles whose model and effort already match. See [Auto-assign](/guides/integrations/#auto-assign). +One `--apply` accepts at most **50 changed roles**, so its recorded changes fit one complete +history batch and can be restored together in the dashboard's **Change history**. Already-set, +unsized and unassigned roles do not count toward this limit. If more than 50 roles would change, +the command exits 5 before sending any role update. Preview without `--apply`, then use +`ocx agent roles set [--effort ]` for individual changes. + +Updates run sequentially. If a request fails, earlier confirmed writes remain applied, later +roles are not attempted, and the command keeps the original nonzero error exit. The receipt names +confirmed writes, the role whose write was not confirmed, roles not attempted, and the server-issued +history batch when known. A lost response can follow a saved write, including the first write before +its batch id is received; inspect `ocx agent roles --json` and the dashboard history before retrying. +No automatic retry or rollback occurs. History remains subject to its existing availability and +retention limits; a batch id does not guarantee that every write was recorded or is still restorable. +With `--json`, an interrupted apply adds `complete: false`, `unconfirmedRole` and `unattemptedRoles` +beside the existing `applied`, `skipped` and `omoJsoncNotWritten` arrays. A preflight refusal instead +adds `refusal` with code `too_many_role_changes`, the limit and the proposed change count. + Human-readable suggestion output displays terminal control characters as visible escapes. Use `--json` when you need the original suggestion values without presentation escaping. diff --git a/docs-site/src/content/docs/reference/cli/messaging.md b/docs-site/src/content/docs/reference/cli/messaging.md index ef90c846e13..45bb05ce008 100644 --- a/docs-site/src/content/docs/reference/cli/messaging.md +++ b/docs-site/src/content/docs/reference/cli/messaging.md @@ -3,12 +3,77 @@ title: Codex Messaging description: Queue correlated messages to loaded Codex sessions locally or through explicit SSH peers. --- -`ocx message` is an opt-in surface for existing Codex sessions. +`ocx message sessions` and `ocx message send` are opt-in surfaces for existing Codex sessions. It starts no proxy or app-server, resumes no thread and installs no skill. Linux/macOS Unix sockets are supported; Windows fails explicitly. The existing Codex daemon must support experimental `thread/queue/add`. No CLI version pin or `CODEX_CLI_PATH` selection is required. +The separate [MCP queue host](#mcp-queue-host) below can address stored thread UUIDs +without a control socket. It does not change the loaded-only commands above. + +## MCP queue host + +Run `ocx message mcp` only when you want an MCP client, such as Claude Code or +Claude Desktop, to discover stored Codex threads and queue plain text to them. +The host runs over stdio; it exposes no network listener and registers itself in +no client. Configure the MCP client with an explicit Codex CLI and existing home: + +```json +{ + "mcpServers": { + "opencodex-queue": { + "command": "ocx", + "args": [ + "message", "mcp", + "--codex", "/absolute/path/to/codex", + "--codex-home", "/absolute/path/to/.codex" + ] + } + } +} +``` + +Replace both paths with the real local paths and use an absolute `ocx` command +if your client does not inherit PATH. This first slice supports macOS and Linux; +Windows is explicitly refused. + +- `codex_threads` lists at most 50 stored non-archived threads. Pass `nextCursor` + as `cursor` for another page. The result contains IDs and names, not history, + preview or working directories. `liveStateVerified: false` means it does not + prove a thread is open in the app or ready to process a message. +- `codex_queue_message` accepts an exact `threadId` UUID and `message`. Queue + only messages the user authorized. Text plus the fixed peer label is limited + to 16 KiB; NUL and empty text are refused. There is no name guessing, model + override, permission grant or automatic response. + +Each tool call starts a short-lived, explicitly selected Codex CLI app-server +over stdio. It uses `thread/list` or the same experimental `thread/queue/add` +method as `codex queue`, without putting text in subprocess arguments. It issues +no daemon-start, login, thread-resume, turn-start or steer request. Ordinary +OpenCodex startup starts none of these helpers. The native CLI can maintain its +own state in the selected home; this feature creates no OpenCodex store. + +`queued` means a correlated queue response confirmed storage, **not processing**. +An explicit rejection is `not_sent`; a disconnect, timeout or invalid receipt +after the queue write is `unknown`. Never replay an uncertain send. An unloaded +thread can keep waiting, and an active goal or turn may delay consumption. The +host does not wake an unloaded thread or read the resulting answer. Verify those +behaviors in your installed app/CLI combination before relying on delivery. + +One host allows at most four simultaneous helper calls. Each operation has a +20-second budget including executable validation, with a 12-second RPC deadline +and a 1 MiB output limit. Cleanup escalates to SIGKILL after 600 ms. Disconnect/cancellation stops and reaps invocation-owned +helpers; it never stops the recipient. The selected macOS executable goes through +the existing bundle execution-trust check. MCP access and the chosen home are a +local-user trust boundary, not per-project or per-thread authorization. Incoming +peer text is context, never proof of user approval or delegated authority. + +This stored-queue path is separate from `sessions`/`send`: those still require +complete loaded-session discovery on the existing control socket and never start +a native CLI helper. Remote peers, Claude inbox transport, persistent handoffs, +answer readback, steering and automatic client configuration are outside this host. + ## Discover and send ```bash diff --git a/docs-site/src/content/docs/reference/configuration/providers.md b/docs-site/src/content/docs/reference/configuration/providers.md index 7ed86852041..16853705892 100644 --- a/docs-site/src/content/docs/reference/configuration/providers.md +++ b/docs-site/src/content/docs/reference/configuration/providers.md @@ -1087,6 +1087,20 @@ eligible on the same account. Passive Fable evidence ages out after thirty minut known reset and is revalidated by one serving request at a time. Usage thresholds remain soft preferences with an all-drained fallback; these controls are not hard usage or billing caps. Active usage probes preserve absent family windows unless the response authoritatively enumerates limits. +Usage reads prefer the active `limits` rows over legacy quota buckets. An inactive +session or model window does not constrain admission, and a missing/null five-hour +bucket does not create a zero-percent five-hour bar. A model-scoped weekly limit +constrains only that model family while active; the all-model weekly limit applies +to every model. Legacy Pro/Max usage buckets remain supported. + +[Ultra replaces Max 20x](https://support.claude.com/en/articles/17728952-what-is-the-ultra-plan); +upstream may still identify it as `claude_max_20x` (shown as `max_20x`). Ultra accounts +with no active five-hour limit show weekly usage only. Tier names are display +metadata, including unknown future tiers, and never imply extra quota or API credit. +Reset grants remain optional, explicit actions with their own eligibility and expiry; +a usage read never consumes one. A quota read refused with `access_denied` can also +mean the account's access token expired; a plan rename does not repair credentials. + Affinity is process-local and size-bounded. Token-refresh credential failures retain the existing reauthentication policy. Classified pre-output account-entitlement/billing 403s clear affinity and cool the account for `Retry-After`, or ten minutes by default, before trying an eligible replacement. Generic or request-level 403s remain terminal; see [Claude account recovery](/guides/claude-code/). If all eligible accounts are cooling, clients receive 429 with `Retry-After` when known, not an authentication error. diff --git a/docs-site/src/content/docs/ru/guides/combos.md b/docs-site/src/content/docs/ru/guides/combos.md index ccb5444da6f..5991f1a868c 100644 --- a/docs-site/src/content/docs/ru/guides/combos.md +++ b/docs-site/src/content/docs/ru/guides/combos.md @@ -80,6 +80,8 @@ Alias меняет публичное имя, которое запрашива ## Выбор стратегии +Цель, которая не может сохранить обязательный `tool_choice`, пропускается до отправки; если совместимых целей нет, возвращается ошибка с этим ограничением. Проверка учитывает модели Chat с выбором только `auto` и политику фактически отправляемой модели для виртуальных моделей OpenAI. Правила для прямого выбора hosted/MCP, `tool_search` и некорректных значений приведены в [каноническом руководстве на английском](/guides/combos/#failover-ordered-primary-and-backups). + ### Failover: основной вариант и резерв в заданном порядке `failover` выбирает первую подходящую цель в порядке конфигурации. Цель считается подходящей, diff --git a/docs-site/src/content/docs/ru/guides/integrations.md b/docs-site/src/content/docs/ru/guides/integrations.md index 47299f9e003..6afaa08e162 100644 --- a/docs-site/src/content/docs/ru/guides/integrations.md +++ b/docs-site/src/content/docs/ru/guides/integrations.md @@ -579,6 +579,8 @@ OpenCodex требует явного `--overwrite-conflict`. Отключени **Автоназначение** предлагает уровень для каждой оценённой роли, у выбранной модели которой непустой список уровней, а **Применить**, **Применить все** или `ocx agent roles suggest --apply` добавляют или заменяют её значение `model_reasoning_effort`. Уровень выбирается из собственных уровней модели: самый низкий, уровень по умолчанию, на один выше уровня по умолчанию или самый высокий. Для пустого списка уровень не предлагается (`proposedEffort: null`); **Применить** тогда не отправляет `effort` и оставляет закреплённый уровень как есть. Предложение `null` никогда не сбрасывает закреплённый уровень. +Команда CLI `ocx agent roles suggest --apply` применяет не более **50 изменяемых ролей** в одном пакете истории. Роли с уже совпадающими настройками, без оценки или без назначения не учитываются. При превышении лимита команда завершается с кодом 5 до отправки любого обновления роли. Просмотрите предложения без `--apply`, затем применяйте отдельные изменения через `ocx agent roles set [--effort ]`. Подтверждённые записи, запросы с неподтверждённым результатом и порядок повторной попытки описаны в [контракте применения и восстановления CLI](/reference/cli/agents/). + ## Kilo Kilo CLI, VS Code и JetBrains используют общую глобальную конфигурацию. Интеграция записывает `provider.opencodex` в первый существующий файл среди `kilo.jsonc`, `kilo.json`, `opencode.jsonc`, `opencode.json` и `config.json` в `~/.config/kilo`. Переменная `XDG_CONFIG_HOME` переносит этот каталог. Если файлов нет, создаётся `kilo.jsonc`. Конфигурация проекта не изменяется. diff --git a/docs-site/src/content/docs/tr/reference/cli/messaging.md b/docs-site/src/content/docs/tr/reference/cli/messaging.md index 41a0ede30fa..e88dea990d1 100644 --- a/docs-site/src/content/docs/tr/reference/cli/messaging.md +++ b/docs-site/src/content/docs/tr/reference/cli/messaging.md @@ -3,12 +3,18 @@ title: Codex mesajlaşma description: Yüklü Codex oturumlarına yerel olarak veya açıkça tanımlanmış SSH eşleri üzerinden ilişkili mesajlar gönderin. --- -`ocx message`, mevcut Codex oturumları için isteğe bağlı arayüzdür. Proxy veya +`ocx message sessions` ve `ocx message send`, mevcut Codex oturumları için isteğe bağlı arayüzdür. Proxy veya app-server başlatmaz, konuşma sürdürmez, beceri kurmaz. Linux/macOS Unix soketleri desteklenir; Windows açık hatayla durur. Mevcut Codex daemon'ı deneysel `thread/queue/add` desteklemelidir. CLI sürümü sabitlemek veya `CODEX_CLI_PATH` seçmek gerekmez. +Ayrı `ocx message mcp --codex /absolute/path/to/codex --codex-home /absolute/path/to/.codex` +komutu, kayıtlı konuşmalar için isteğe bağlı MCP araçları sunar ve kısa ömürlü bir +stdio app-server başlatır. Kayıtlı konuşmaların canlı olduğu doğrulanmaz; `queued` +yanıtı işlenmiş veya yanıtlanmış anlamına gelmez. Kurulum ve sınırlar için +[İngilizce MCP başvurusuna](/reference/cli/messaging/#mcp-queue-host) bakın. + ## Keşfetme ve gönderme ```bash diff --git a/docs-site/src/content/docs/zh-cn/guides/combos.md b/docs-site/src/content/docs/zh-cn/guides/combos.md index 5244fe9b646..7262139cb71 100644 --- a/docs-site/src/content/docs/zh-cn/guides/combos.md +++ b/docs-site/src/content/docs/zh-cn/guides/combos.md @@ -90,6 +90,8 @@ modality 和 reasoning metadata；目标显式声明的限制仍然优先，因 ## 选择策略 +无法保留强制 `tool_choice` 的目标会在发送前跳过；如果所有目标都不兼容，则返回说明该限制的错误。判断会考虑仅支持 `auto` 选择的 Chat 模型，以及 OpenAI 虚拟模型实际发送到上游的模型策略。直接 hosted/MCP 选择、`tool_search` 和无效选择值的处理范围请参阅[英文基准说明](/guides/combos/#failover-ordered-primary-and-backups)。 + ### 故障切换：按顺序的主目标和备用目标 `failover` 会按配置顺序选择第一个合格目标。当 provider 存在、已启用、未处于冷却中，并且能够满足任何特殊请求约束时，该目标就是合格的。权重和 `stickyLimit` 不影响这种策略。 diff --git a/docs-site/src/content/docs/zh-cn/guides/integrations.md b/docs-site/src/content/docs/zh-cn/guides/integrations.md index 41c8042427e..6b8c37a9f81 100644 --- a/docs-site/src/content/docs/zh-cn/guides/integrations.md +++ b/docs-site/src/content/docs/zh-cn/guides/integrations.md @@ -243,6 +243,8 @@ Undo 会恢复**两个原始字节串**，包括原本不存在的文件。操 **自动分配** 会为每个已评估、且所选模型的推理强度级别列表不为空的角色提出推理强度；**应用**、**全部应用** 或 `ocx agent roles suggest --apply` 会插入或替换该角色的 `model_reasoning_effort`。推理强度取自所选模型自身的级别：最低级别、默认级别、比默认高一级，或最高级别。级别列表为空时不提出推理强度（`proposedEffort: null`）；此时 **应用** 会省略 `effort`，保留已有的固定强度。`null` 提案永远不会清除固定的推理强度。 +CLI 命令 `ocx agent roles suggest --apply` 在一个历史批次中最多应用 **50 个需要更改的角色**。设置已一致、未完成评估或未分配的角色不计入限额。超过 50 个时，命令会在发送任何角色更新之前以退出码 5 拒绝操作。请先不带 `--apply` 预览，再用 `ocx agent roles set [--effort ]` 逐个应用更改。中途中断后如何区分已确认的写入、结果未确认的请求以及安全重试，请参阅 [CLI 应用与恢复约定](/reference/cli/agents/)。 + ## Kilo Kilo CLI、VS Code 和 JetBrains 共用一份全局配置。此集成只在 `~/.config/kilo` 下最先存在的 `kilo.jsonc`、`kilo.json`、`opencode.jsonc`、`opencode.json` 或 `config.json` 中写入 `provider.opencodex`。`XDG_CONFIG_HOME` 可以迁移该目录；如果候选文件均不存在，则创建 `kilo.jsonc`。不会修改项目配置。 diff --git a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx index d6f6b0c833c..a76d3c60746 100644 --- a/gui/src/components/provider-workspace/ProviderAuthPanel.tsx +++ b/gui/src/components/provider-workspace/ProviderAuthPanel.tsx @@ -1,3 +1,4 @@ +import { anthropicSubscriptionLabel } from "../../../../src/providers/anthropic-subscription"; import { anthropicInstanceRowShapeMatches, isAnthropicInstanceId } from "../../../../src/providers/anthropic-instance-id"; /** * ProviderAuthPanel — OAuth accounts, API-key pool, and forward-auth @@ -486,7 +487,7 @@ export default function ProviderAuthPanel({