Sync upstream Soju06/codex-lb main

.all-contributorsrc

@@ -1264,6 +1264,17 @@
         "test"
       ]
     },
+    {
+      "login": "NikitaMGrimm",
+      "name": "Nikita Maximilian Grimm",
+      "avatar_url": "https://avatars.githubusercontent.com/u/65914808?v=4",
+      "profile": "https://github.com/NikitaMGrimm",
+      "contributions": [
+        "code",
+        "doc",
+        "test"
+      ]
+    },
     {
       "login": "BrenticusMaximus",
       "name": "BrenticusMaximus",
@@ -1436,6 +1447,91 @@
         "test",
         "doc"
       ]
+    },
+    {
+      "login": "VictorStatko",
+      "name": "Victor Statko",
+      "avatar_url": "https://avatars.githubusercontent.com/u/34319599?v=4",
+      "profile": "https://github.com/VictorStatko",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "janaki-sasidhar",
+      "name": "flameboy",
+      "avatar_url": "https://avatars.githubusercontent.com/u/42799643?v=4",
+      "profile": "https://github.com/janaki-sasidhar",
+      "contributions": [
+        "doc"
+      ]
+    },
+    {
+      "login": "elmakus",
+      "name": "elmakus",
+      "avatar_url": "https://avatars.githubusercontent.com/u/76910687?v=4",
+      "profile": "https://github.com/elmakus",
+      "contributions": [
+        "code",
+        "test",
+        "bug"
+      ]
+    },
+    {
+      "login": "Abaddollyon",
+      "name": "Abaddollyon",
+      "avatar_url": "https://avatars.githubusercontent.com/u/31712865?v=4",
+      "profile": "https://github.com/Abaddollyon",
+      "contributions": [
+        "code",
+        "test"
+      ]
+    },
+    {
+      "login": "mjakl",
+      "name": "Markus Jakl",
+      "avatar_url": "https://avatars.githubusercontent.com/u/40384?v=4",
+      "profile": "https://github.com/mjakl",
+      "contributions": [
+        "code",
+        "test",
+        "bug"
+      ]
+    },
+    {
+      "login": "felixcake618",
+      "name": "Felix Cake",
+      "avatar_url": "https://avatars.githubusercontent.com/u/91266981?v=4",
+      "profile": "https://github.com/felixcake618",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "uniskela",
+      "name": "Uniskela",
+      "avatar_url": "https://avatars.githubusercontent.com/u/104075208?v=4",
+      "profile": "https://github.com/uniskela",
+      "contributions": [
+        "doc"      ]
+    },
+    {
+      "login": "nhdong1993",
+      "name": "nhdong1993",
+      "avatar_url": "https://avatars.githubusercontent.com/u/86702790?v=4",
+      "profile": "https://github.com/nhdong1993",
+      "contributions": [
+        "code"
+      ]
+    },
+    {
+      "login": "tubededentifrice-dev",
+      "name": "Vincent Dev",
+      "avatar_url": "https://avatars.githubusercontent.com/u/246649517?v=4",
+      "profile": "https://github.com/tubededentifrice-dev",
+      "contributions": [
+        "code"
+      ]
     }
   ],
   "contributorsPerLine": 7,

.env.example

@@ -23,6 +23,7 @@
 # https://soju06.github.io/codex-lb/authentication/
 # CODEX_LB_DASHBOARD_AUTH_MODE=standard
 # CODEX_LB_DASHBOARD_AUTH_PROXY_HEADER=Remote-User
+# CODEX_LB_DASHBOARD_AUTH_PROXY_GROUPS_HEADER=Remote-Groups
 
 # Behind a reverse proxy? Trust X-Forwarded-For from these sources only:
 # https://soju06.github.io/codex-lb/deployment/remote/

.github/dependabot.yml

@@ -27,6 +27,10 @@ updates:
       day: "monday"
     open-pull-requests-limit: 10
     groups:
+      vitest:
+        patterns:
+          - "vitest"
+          - "@vitest/*"
       frontend-minor-patch:
         update-types:
           - "minor"

.github/labeler.yml

@@ -2,3 +2,38 @@ db migration:
   - changed-files:
       - any-glob-to-any-file:
           - app/db/alembic/versions/**
+
+documentation:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '**/*.md'
+          - docs/**
+          - openspec/**
+          - mkdocs.yml
+
+python:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '**/*.py'
+          - pyproject.toml
+          - uv.lock
+
+frontend:
+  - changed-files:
+      - any-glob-to-any-file:
+          - frontend/**
+
+ci:
+  - changed-files:
+      - any-glob-to-any-file:
+          - .github/workflows/**
+          - .github/labeler.yml
+          - .github/actions/**
+
+docker:
+  - changed-files:
+      - any-glob-to-any-file:
+          - '**/Dockerfile*'
+          - '**/*compose*.yml'
+          - '**/*compose*.yaml'
+          - .dockerignore

.github/scripts/detect_changed_areas.py

@@ -35,6 +35,11 @@
         "docs/reference/settings.md",
         ".env.example",
         ".github/simplicity-budgets.toml",
+        "Cargo.toml",
+        "Cargo.lock",
+        "crates/**",
+        "Dockerfile",
+        "Dockerfile.*",
     ],
     "rust": [
         "Cargo.toml",
@@ -45,6 +50,7 @@
         "app/core/clients/codex.py",
         "app/core/clients/http.py",
         "app/core/clients/native_egress.py",
+        "app/core/clients/usage.py",
         "app/core/clients/stream_errors.py",
         "app/core/clients/proxy.py",
         "app/core/clients/proxy_websocket.py",
@@ -55,10 +61,12 @@
         "pyproject.toml",
         "uv.lock",
         "tests/unit/test_native_egress.py",
+        "tests/unit/test_usage_client.py",
         "tests/unit/test_native_egress_packaging.py",
         "tests/unit/test_native_sse_fixtures.py",
         "tests/integration/test_native_routed_egress.py",
         "tests/integration/test_native_sse_egress.py",
+        "tests/integration/test_native_usage_egress.py",
         "Dockerfile",
         "Dockerfile.*",
         "Makefile",

.github/scripts/validate_changed_openspec.py

@@ -0,0 +1,57 @@
+"""Strictly validate active OpenSpec changes touched by the GitHub event."""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+from pathlib import Path
+
+
+def git(*args: str) -> str:
+    return subprocess.check_output(["git", *args], text=True)
+
+
+def main() -> None:
+    event = json.loads(Path(os.environ["GITHUB_EVENT_PATH"]).read_text())
+    event_name = os.environ["GITHUB_EVENT_NAME"]
+    if event_name == "pull_request":
+        pull_request = event["pull_request"]
+        head = pull_request["head"]["sha"]
+        base = git("merge-base", pull_request["base"]["sha"], head).strip()
+    elif event_name == "push":
+        base, head = event["before"], event["after"]
+    elif event_name == "merge_group":
+        base, head = event["merge_group"]["base_sha"], event["merge_group"]["head_sha"]
+    else:
+        raise ValueError(f"Unsupported event: {event_name}")
+    if event_name == "push" and base == "0" * 40:
+        paths = git("ls-tree", "-r", "--name-only", "-z", head, "--", "openspec/changes/")
+    else:
+        paths = git("diff", "--name-only", "-z", "--no-renames", base, head, "--", "openspec/changes/")
+    changes = set()
+    for path in paths.split("\0"):
+        parts = path.split("/")
+        if len(parts) >= 4 and parts[:2] == ["openspec", "changes"] and parts[2] != "archive":
+            if Path(*parts[:3]).is_dir():
+                changes.add(parts[2])
+    for change in sorted(changes):
+        subprocess.run(
+            [
+                "npx",
+                "--yes",
+                "@fission-ai/openspec@1.11.0",
+                "validate",
+                "--type",
+                "change",
+                "--strict",
+                "--no-interactive",
+                "--",
+                change,
+            ],
+            check=True,
+        )
+
+
+if __name__ == "__main__":
+    main()

.github/simplicity-budgets.toml

@@ -23,7 +23,7 @@ max_lines = 60
 # Single source of truth for dashboard nav width. If the nav refactor moves or
 # renames this array, the checker exits 2 until path/array here are repointed —
 # that coupling is intentional.
-path = "frontend/src/components/layout/app-header.tsx"
+path = "frontend/src/components/layout/nav-items.ts"
 array = "CORE_NAV_ITEMS"
 max_items = 5
 
@@ -51,7 +51,16 @@ max_items = 5
 # 130 -> 103 constantize-core-tunables turned 27 never-tuned core tunables
 # into fixed constants (#1340 precedent, slop-removal 0908 K1); 103 -> 96
 # K2 bridge: constantize-session-bridge-tunables fixed seven never-tuned
-# HTTP session bridge tunables.
+# HTTP session bridge tunables; 96 -> 95 drop-bridge-recovery-modes deleted
+# the ambiguous-continuation recovery mode selector (fail-closed is the only
+# behaviour now); 95 -> 96 dashboard_auth_proxy_groups_header (the reverse
+# proxy's group header must match that proxy's config, so it cannot be a
+# dashboard row, PR-2c-2); 96 -> 95 constantize-token-refresh-interval fixed
+# the proactive token-refresh window at eight days and emptied the `MIGRATING`
+# backlog; 95 -> 96 thread_cache_identity_mode (a fleet-wide behaviour switch an
+# operator must be able to roll back without a deploy, so it needs a dashboard
+# home; the environment leg exists only so an operator locked out of the
+# dashboard can still pin the mode at boot, and it is a fallback, never a seed).
 max = 96
 
 [root_files]
@@ -99,6 +108,7 @@ allowed = [
   "renovate.json",
   "rust-toolchain.toml",
   "scripts",
+  "spec",
   "tests",
   "uv.lock",
 ]