You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
{{ message }}
Repository navigation
feat(providers): opt-in request-local API key round-robin and per-key pacing - #6937
Healthy requests use the saved API key by default. Opt-in requestPacing.keySelection: "round-robin" allocates a request-local key without changing the saved selection; requestPacing.keys adds per-key RPM, interval and concurrency limits that compose with provider and model limits.
Queued native Chat, Messages, Responses and compact requests revalidate key membership/revision/cooldown, rebuild a healthy binding and reacquire its pacing capacity. Replacement admission retains client cancellation without consuming the response-header timeout. An established stateful turn cannot switch a cooled credential; pre-output key rejection uses the existing bounded recovery. Key cooldown state lives in a dependency-light leaf and retains the longest outstanding expiry, including concurrent 401/429 failures and duplicate references. Per-key pacing and round-robin use guarded HTTP/SSE even when upstream WebSockets are enabled; WS-only steering/injection requires a route without those key policies. Owned pacing body wrappers preserve opaque WS/native-control markers and live stage metadata, without marking unowned responses.
The dashboard includes save/discard controls and opaque key diagnostics. Standalone Images remains a single-send direct relay outside inference pacing; genuine distributed 401/429 responses cool the actual key without replaying that paid POST. Limits and the cursor are process-local; this does not implement token/cost balancing or TPM/RPD scheduling. Existing contributor commits and GUI screenshot evidence are preserved.
Verification
Final head: 8bf1f2907834eb7c350c5d34b9ace7a8da4aa3c9. Includes integration base 7af092ca4f78828238b425bf351d5989e237f89f through a normal merge, preserving contributor history.
Existing key-failover, native Messages, pacing and runTurn tests: 168 pass; new Messages/cooldown files: 14 pass; key endpoint/management coverage: 48 pass.
Header deadline and fetch-helper boundary coverage: 26 pass, including queued replacement past the header timeout, fresh physical-send timeout and client cancellation.
WS transport/marker/steering/injection/quota and boundary coverage: 241 pass (12 new provenance cases); guarded HTTP/header tests combined with the new provenance cases: 23 pass; key pacing/header batch: 42 pass.
Final active selection guards keep manual A→B switches under per-key limits: Chat/Messages/compact acquire B’s capacity after releasing A, with blocked-B/cancellation proofs. Before fix: 0 pass, 6 fail; final focused batch: 66 pass; final guards: 53 pass.
Configured Messages Bearer transport recovers genuine 401/429 while rejecting overridden credentials; regression red before correction (2 pass, 2 fail), final Messages/OAuth/inference batch: 190 pass; layout/ratchet/Lab: 53 pass.
Final mixed Messages/key cooldown regression batch: 186 pass; native Messages spend-anchor: 2 pass; direct compact/Images cooling: 13 pass. The final Chat wire-ownership regression is red before correction (0 pass, 2 fail) and green afterward; Chat/inference/spend-anchor: 81 pass, Chat combo/spend/stall and boundary/layout guards: 86 pass. Exact-head receipt across Chat/Messages key selection, compact and Images regressions: 46 pass, 0 fail.
Cooldown/key-failover, including longest-expiry/manual-clear regression: 47 pass.
Additional Chat/compact and final guards: 170 pass across native Chat/keyed compact/handoff/routing/header-timeout coverage; layout, file-size and core Lab guards: 53 pass.
bun run typecheck, bun run privacy:scan, bun run structure:check, git diff --check: PASS.
bun run lint:gui, bun run build:gui: PASS. GUI source has not changed after those checks. Documentation build: 569 pages, 79,332 internal links validated.
Pre-fix e5f050ca3ef fails the cooled exact-binding regression (0 pass, 1 fail); repaired head passes it.
bun run test:changed waited 360 seconds for the shared runner lock, then was interrupted (exit 130) during the broad run while final-review repairs changed the code. Fourteen failure observations appeared in six files. Those six files were rerun separately at clean integration base (377 pass, 1 skip, 0 fail) and repaired earlier head e9e1bcf04eba4fcbdffd897293e008ec2803f562 (377 pass, 1 skip, 0 fail). This establishes no persistent failure in those focused reruns; it does not establish the cause of the broad-run observations or coverage for unfinished files.
Full-suite resource exception: five concurrent lanes share this host. Focused behavioral and source-data/layout/Lab guards are recorded above; unfinished broad coverage and cross-platform CI are deferred to the coordinator's integrated final dev run. No hosted workflow was started or CI pass claimed.
Fresh independent gpt-6.1-sol review at the exact pushed head: PASS, Security PASS, 62/62 files reviewed, P0/P1/P2 all zero. Independent focused verification: 353 pass, 0 fail; typecheck, structure, privacy and diff check pass. Full-suite and hosted CI remain outside this authorized lane scope.
Checklist
Scope stays focused and avoids unrelated cleanup.
Docs or release notes were updated when needed.
Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.
Review readiness checklist
Required local validation passed; commands, results, and any full-suite exception are documented.
I pushed my PR to a recent dev commit (at most 10 behind; a maintainer may still ask for the exact tip before merge).
I resolved all correct Codex and CodeRabbit findings.
My PR is ready for review.
Draft is retained for the coordinator’s integration decision and final cross-platform CI timing. Lane-local validation and independent exact-head review are complete; no hosted CI pass or merge is claimed.
Summary
Healthy requests use the saved API key by default. Opt-in
requestPacing.keySelection: "round-robin"allocates a request-local key without changing the saved selection;requestPacing.keysadds per-key RPM, interval and concurrency limits that compose with provider and model limits.Queued native Chat, Messages, Responses and compact requests revalidate key membership/revision/cooldown, rebuild a healthy binding and reacquire its pacing capacity. Replacement admission retains client cancellation without consuming the response-header timeout. An established stateful turn cannot switch a cooled credential; pre-output key rejection uses the existing bounded recovery. Key cooldown state lives in a dependency-light leaf and retains the longest outstanding expiry, including concurrent 401/429 failures and duplicate references. Per-key pacing and round-robin use guarded HTTP/SSE even when upstream WebSockets are enabled; WS-only steering/injection requires a route without those key policies. Owned pacing body wrappers preserve opaque WS/native-control markers and live stage metadata, without marking unowned responses.
The dashboard includes save/discard controls and opaque key diagnostics. Standalone Images remains a single-send direct relay outside inference pacing; genuine distributed 401/429 responses cool the actual key without replaying that paid POST. Limits and the cursor are process-local; this does not implement token/cost balancing or TPM/RPD scheduling. Existing contributor commits and GUI screenshot evidence are preserved.
Verification
Final head:
8bf1f2907834eb7c350c5d34b9ace7a8da4aa3c9. Includes integration base7af092ca4f78828238b425bf351d5989e237f89fthrough a normal merge, preserving contributor history.bun run typecheck,bun run privacy:scan,bun run structure:check,git diff --check: PASS.bun run lint:gui,bun run build:gui: PASS. GUI source has not changed after those checks. Documentation build: 569 pages, 79,332 internal links validated.e5f050ca3effails the cooled exact-binding regression (0 pass, 1 fail); repaired head passes it.bun run test:changedwaited 360 seconds for the shared runner lock, then was interrupted (exit 130) during the broad run while final-review repairs changed the code. Fourteen failure observations appeared in six files. Those six files were rerun separately at clean integration base (377 pass, 1 skip, 0 fail) and repaired earlier heade9e1bcf04eba4fcbdffd897293e008ec2803f562(377 pass, 1 skip, 0 fail). This establishes no persistent failure in those focused reruns; it does not establish the cause of the broad-run observations or coverage for unfinished files.Checklist
Review readiness checklist
Draft is retained for the coordinator’s integration decision and final cross-platform CI timing. Lane-local validation and independent exact-head review are complete; no hosted CI pass or merge is claimed.