Highlights
TokenHub v0.8.0 brings a plugin platform and management overhaul, richer pricing and cost statements, expanded model catalogs, and fixes across gateway execution, deployment, and the admin console. This release covers every change from v0.7.0 to v0.8.0, including the complete commit inventory below.
- Plugin API v2 and management: inspectable built-in Provider plugins, declarative admin contributions, interface templates, package installation and updates, rollback, persistent lifecycle state, and verified Marketplace discovery.
- Gateway and Provider architecture: manifest-driven Provider policies and resource actions, consistent scoped gateway stages, protocol-aware admission, streaming transforms, and preserved legacy Provider compatibility.
- Billing and FinOps: weekday/time-zone pricing windows, cache-write pricing tiers, immutable exact shadow rate cards and exchange rates, request/attempt evidence, and separate customer, Provider, and estimated-margin statements with CSV export.
- Models and connectivity: StepFun direct and Step Plan presets, twelve curated StepFun models, GPT-6 Astra catalog support, model-aware reasoning controls, and supported local/private upstream configuration.
- Console and operations: clearer plugin installation, lifecycle, settings, and error states; localized catalog errors and model counts; persistent plugin volumes; and expanded acceptance, migration, and release packaging checks.
External executable plugins are not operational in v0.8.0. Packages with
entry.backend.commandare rejected before launch and recorded asfailed_startup, because TokenHub cannot yet enforce the required host-level process, network, and resource isolation. They remain installed and inspectable, but register no Provider adapter, gateway hook, background job, or management action. In-process built-ins and supported declarative presentation packages remain available. The DevKit exercises the future command contract locally; its examples are fixtures, not production integrations.
Detailed changes
Plugin platform, lifecycle, and distribution
- Introduce Plugin API v2 manifests, compatibility and dependency checks, capability declarations, permissions, trust policies, action input/output schemas, and separate installation, activation, startup, fallback, and rollback state.
- Represent the built-in Provider catalog as generated, inspectable plugin packages. Derive Provider types, labels, categories, default URLs, authentication modes, credentials, resource types, route protocols, managed headers, discovery behavior, session affinity, reasoning controls, error handling, and image policies from declarations.
- Route Provider lifecycle operations through declared actions, including OAuth start/callback exchange, credential refresh, reauthorization, account probes, model discovery/import, quota reads/resets/monitoring, and image capability configuration. Preserve legacy aliases, routes, resources, quota state, and usage/audit compatibility during migration.
- Add verified ZIP and URL installation, file inspection, updates, uninstall, enable/disable, rollback, permission-diff previews, and explicit startup quarantine. Supported declarative changes are reevaluated without restarting the service; stale restart markers are cleared after application.
- Persist built-in Provider, Admin UI, and interface-template lifecycle state across restarts. Disabled or failed built-ins remain inspectable while publishing no active UI contributions, actions, or scheduled jobs; re-enabling restores supported operation.
- Preserve neighboring plugin directories and the current package during updates. Rejected checksum, signature, dependency, or validation checks retain the existing rollback backup, including legacy installation layouts and plugin IDs ending in
.previous. - Add Marketplace index validation, channel browsing, compatible release selection, strict SemVer update ordering, checksums, Ed25519 artifact-signature verification, trust metadata, and revocation-aware discovery. Downloads require validated public HTTPS destinations and safe same-origin redirects.
- Connect installed-package update controls to installable Marketplace candidates and their signature metadata. Invalidate permission previews when the selected artifact changes, clear stale ZIP selections when preparing URL installation, and retain operation feedback when filtering removes a row.
- Keep the Marketplace website unset until configured; hide the external Browse link when unavailable. Uninstalled package details remain navigable with correct Provider classification; discovery-only entries without verified distribution metadata remain non-installable.
- Add background scheduling state, retries, cancellation on shutdown, redacted results, and audit correlation for supported built-in execution. External command jobs remain subject to the startup restriction above.
Gateway behavior and Provider compatibility
- Define ordered gateway stages and a common request envelope for decode/normalize, authentication context, admission, privacy, context optimization, cache, guardrails, routing candidates/ranking, request transformation, Provider calls, response processing, usage attribution, stream events, and trace export.
- Apply stage ordering and hook contracts across Chat Completions, Responses and response jobs, Embeddings, Anthropic Messages, Gemini, images/image jobs, compact Responses, and Playground paths. Expand failover, cache, response transformation, stream guardrail, attempt-isolation, and audit coverage.
- Match the complete request scope and declared output mode before admitting
provider_callroutes: streaming calls requirestream_events; other calls requireprovider_response. Preserve adapter capabilities, protocol bridges, and non-response hooks, and exclude unsupported plugin-only routes before invocation without penalizing Provider resources. - Preserve endpoint and operation scope through streaming and bridge paths. Reject ambiguous Provider/resource scopes before route selection; list-stage hooks use project, key, endpoint, or operation scopes. Stream-transform declarations may write events and audit data, not final usage or full-response payloads.
- Preserve Provider-level routes, credential scope, resource identity, metadata-based catalog caches, image model backfill, and protocol-specific behavior while removing Provider-specific defaults from the generic server and frontend paths. Empty upstream error bodies now produce a non-empty message containing the original HTTP status, without changing error classification or failover behavior.
- Support local/private self-hosted model services after explicitly setting
TOKENHUB_PROVIDER_UPSTREAM_ACCESS_MODE=auto, with clearer blocked-address diagnostics and network configuration guidance. Strict mode remains the default, configured allowlists remain restrictive, and protected special-use targets stay denied. Marketplace downloads retain their separate public-HTTPS policy.
Pricing, billing evidence, and cost statements
- Add pricing periods with weekdays, IANA time zones, effective date ranges, overnight windows, and input/output/cache-read/cache-write overrides, including separate 5-minute and 1-hour cache-write rates. Validate overlaps, window counts, finite non-negative prices, and explicit zero versus inherited or omitted prices.
- Preserve explicitly free cache prices across PATCH, save, and reload. Tenant legacy prices are captured at admission, while Provider prices are captured before each routed attempt so in-flight edits cannot change that attempt's cost.
- Add administrator-managed immutable decimal-string shadow rate cards, versioned exchange rates, preview-before-publish controls, and request/attempt evidence. Exact comparisons use rational arithmetic and a single half-even rounding step; missing usage, prices, FX, or delivery evidence stays explicit.
- Add schema expansion 4 with
metering_entriesand its index, plus expansion 5 for audit-event correlation. Extend schema verification and preserve legacy PostgreSQL audit records across upgrade; capture billing evidence in the existing settlement transaction. Capture identity, attribution, prices, FX, upstream request IDs, and outcomes without prompt bodies, response bodies, or credentials. - Add platform-admin customer, Provider, and estimated-margin statements with date/time-zone filters, preview, and CSV export. Customer statements require explicit project selection and omit supplier identity and procurement prices. Provider statements include attempts and retries and keep local estimates separate from original-currency supplier totals.
- Keep margin estimates tied to recorded customer charges and matching request costs, including cross-month retries. Suppress margin when costs, FX, historical evidence, or completion evidence are incomplete. Unknown legacy zero cost is not treated as a free charge; explicitly evidenced zero remains zero.
- Snapshot external billing Provider/resource attribution at ingestion, preserve it across reimport and connector edits/deletion, and backfill legacy rows before mutation or statement generation. Exclude non-instantaneous records ending at the period's start before applying the row limit.
- Fail reconciliation explicitly with
reconciliation_provider_cost_unknownwhen a legacy zero lacks evidence. Statements fail above 10,000 rows instead of silently truncating and support ranges up to 93 days with an exclusive end.
Models, admin console, and interface templates
- Add China/global StepFun direct and Step Plan presets and twelve curated reference models, including
step-3.7-flash, with capabilities, modalities, prices, limits, and reasoning metadata. Preserve curated entries during catalog refresh and test Provider/model coverage in both directions. - Add
gpt-6-astrato the model directory and built-in OpenAI inventory, and preserve itsmaxreasoning effort in Codex probes and Anthropic-to-Codex requests. Catalog access still requires an authorized route; fixed Standard prices do not automatically apply long-context or alternate service-tier pricing. Make Playground reasoning-effort options model-aware and clear stale selections when switching models. - Redesign plugin management tabs, filters, metrics, installation dialogs, details, file inventories, settings, lifecycle controls, and responsive row actions. Clarify unavailable capabilities, empty states, startup failures, fallback/rollback state, update feedback, and nullable/legacy API payloads.
- Refresh plugin rows, counters, and filters after lifecycle changes, reset file previews when switching packages, and limit theme-token editing to supported tokens. Keep browser fixture package state in temporary storage.
- Add declarative Provider form/resource panels, route/settings panels, dashboard cards and composition, navigation pages, reports, page layouts, theme tokens, and validated action bindings. Add selectable default, Ant Design, and knowledge-sidebar interface templates and preserve active plugin kinds and selection state.
- Localize built-in plugin and admin copy in English, Simplified Chinese, and Japanese while preserving canonical template names and Provider data. Format numbers and model count ratios by locale.
- Keep proxy test actions on one line, align paired cards, localize modality selector tags, and replace raw catalog authentication/rate-limit/transport failures with actionable localized states. Preserve selected/visible model counts against catalog totals and keep refresh usable after upstream failures.
Deployment, developer tools, tests, and documentation
- Include built-in Provider and platform packages in native archives and managed container images. Allow the tracked built-in plugin directory through
.dockerignore, fixing the container build failure discovered during v0.8.0 preparation; add a real Docker build-context regression check to CI. - Initialize and repair ownership of the configured plugin root before dropping container privileges. Validate absolute non-root paths, preserve packages on named volumes, and test lifecycle operations and restart persistence for default and custom plugin paths.
- Use the bundled Node.js runtime for the migration fixture's TokenHub health check, replacing an unavailable
wgetdependency in the slim container image. Point the migration fixture at its Compose mock-upstream service and explicitly enable local test-network access; production retains strict mode by default. - Synchronize backend source/container default versions and frontend/SDK package metadata to
0.8.0. - Add a separate Plugin DevKit with a Go SDK,
tokenhub-plugin-testCLI, generated production-compatible manifest validation, protocol fixtures, and Provider/action/hook/background-job contract suites. Examples include mock, Kimi, and GLM Provider fixtures, an echo action, trace hook, and heartbeat job. - Add database-free UI acceptance scenarios and capture galleries with strict declared-request assertions, synthetic data, capture metadata, and segmented mobile screenshots. Expand frontend component/domain/browser coverage and backend lifecycle, billing, PostgreSQL, migration, and legacy compatibility tests.
- Add core-boundary and Provider-hardcoding gates, generated built-in package checks, localization checks, and DevKit CI. Harden gateway RPM tests around UTC minute rollover and clean up legacy helpers and worker lifetimes.
- Add and synchronize plugin architecture, getting started, manifest, Provider, gateway-hook, UI-template, background-job, packaging, billing, gateway, and deployment documentation across English, Simplified Chinese, and Japanese. Update repository guidance for named UI acceptance fixtures.
Upgrade notes and current limits
- Back up the database and plugin directory before upgrading. Normal startup applies the pending additive migrations, including schema 4 metering evidence and schema 5 audit correlation. Preserve those additions when restoring or rolling back and use a compatible binary; evidence has no automatic retention cleanup yet. Existing database preflight and verification commands remain available.
- Persist and coordinate plugins. Compose uses the
tokenhub-pluginsvolume forTOKENHUB_PLUGIN_DIR; multi-instance deployments must coordinate the same package versions across replicas. Custom container plugin paths must be absolute and non-root. - Check external package expectations. External command-bearing packages stay installed but enter
failed_startup; they cannot execute through TokenHub in this release. Use the DevKit for local command-contract development and built-ins/supported declarative packages for currently supported runtime behavior. - Configure Marketplace endpoints explicitly. The index and optional website are operator settings. Online discovery is not proof of an installable or trusted artifact; review compatibility, checksum, signature/trust state, and permission changes.
- Shadow pricing does not change actual customer charges or reserve money. Active exact charging, durable monetary reservations, recovery/manual queues, and full background-transport attempt evidence remain follow-up work. Cost statements do not confirm agreement, dispute resolution, or payment, and estimated margin is not net profit or cash balance.
- Historical billing evidence has limits. Connector changes made before upgrade cannot be reconstructed. Incomplete legacy prices, FX, usage, or attempt outcomes remain unknown rather than being inferred as zero.
- The OpenAI-compatible
/v1contract remains compatible. Built-in Provider operations remain supported, subject to their configured lifecycle state and declared capabilities.
Documentation: Plugin development · Pricing and statements · Deployment
Validation
- Full release-preparation checks: CI and Migration CI, covering backend tests/vet/pinned lint, Plugin DevKit, frontend checks/build, browser smoke, PostgreSQL, N-1 database compatibility, deployment, repository gates, and the real LiteLLM migration cycle.
- Local checks also passed for backend tests/vet, DevKit tests/vet, Node 22.23.1 frontend checks/build, all 10 browser smoke tests, all 175 repository gate tests, translation/environment/source-line checks, Docker build context, and Compose rendering.
- Credential-dependent live-provider SDK smoke tests were not run. Integration checks used synthetic data and mock upstreams.
Release artifacts
tokenhub_0.8.0_linux_amd64.tar.gztokenhub_0.8.0_linux_arm64.tar.gzchecksums.txtwith SHA-256 checksums for the native archives- Multi-architecture container image:
ghcr.io/astaxie/tokenhub-backend:0.8.0, with stable aliases:0.8and:latest
All merged pull requests since v0.7.0
This list includes PRs merged into the plugin development branch before that branch reached main.
- #294 — feat(models): add StepFun direct and Step Plan catalogs — @deepjerry-ai
- #295 — fix(admin): polish layouts and provider catalog errors — @deepjerry-ai
- #305 — fix: refresh plugin architecture and restore backend CI — @deepjerry-ai
- #306 — fix(admin): resolve plugin management findings from live testing — @legendtkl
- #307 — fix(provider): show blocked IPs and network configuration guidance — @deepjerry-ai
- #308 — feat(provider): allow self-hosted models without network opt-in — @deepjerry-ai
- #310 — feat(billing): add time and cache pricing with shadow evidence — @deepjerry-ai
- #312 — feat(billing): add upstream and customer cost statements — @deepjerry-ai
- #313 — fix(i18n): localize built-in plugin UI and admin copy — @deepjerry-ai
- #315 — feat(plugins): overhaul plugin platform and management — @astaxie
- #317 — feat(models): add gpt-6-astra support — @deepjerry-ai
- #318 — test(ui): add database-free acceptance scenarios and gallery — @deepjerry-ai
- #327 — chore(release): prepare v0.8.0 — @astaxie
Complete commit inventory
The range contains 638 commits and 13 merged PRs, including merge commits. Historical commit titles describe work as it landed; the runtime limitations above describe the final shipped behavior.
Expand every commit since v0.7.0
- 743aa8db1 feat(models): add StepFun catalog models
- 40ca79863 test(models): guard catalog drift
- 8ba779ce0 test(gateway): handle RPM minute rollover
- 39fc1e1e9 fix(models): correct StepFun direct catalog
- 5ae3bd090 fix(models): keep upstream catalog refresh usable
- 8b26f508d Merge pull request #294 from astaxie/codex/update-stepfun-models
- 6bd5325e5 fix(settings): keep proxy test action on one line
- 2830516cf fix(models): localize modality selector values
- edbeca46c fix(layout): align paired data sections
- 65facb672 fix(provider): clarify model catalog error states
- 8c66cf51b fix(provider): localize catalog transport failures
- 6aecbdb90 fix(provider): localize model count summaries
- ac30a839e fix(provider): preserve model count ratios
- 6e6bc7194 Merge pull request #295 from astaxie/codex/fix-admin-ui-overflow
- 8d6ffac94 feat(plugins): add plugin runtime foundations
- 6f85c30b5 feat(plugins): run trace export gateway hooks
- 33bae2c49 feat(plugins): run route rank gateway hooks
- a1d022668 feat(plugins): run privacy pre gateway hooks
- 2fb4b8dc5 feat(plugins): run cache gateway hooks
- f7edba154 feat(plugins): add admin plugin action broker
- e0f958b44 feat(plugins): load manifest action descriptors
- fcbe7e15b feat(plugins): execute stdio action handlers
- 75310c77f feat(plugins): execute stdio gateway hooks
- 0e0f50660 feat(plugins): load stdio provider adapters
- 58bf28e35 feat(plugins): expand stdio provider operations
- 024bd1aca feat(plugins): support provider models and probe
- 0fa7f0ac0 feat(plugins): expose provider plugins in catalog
- 8a0f7636d feat(plugins): link UI contributions to actions
- 619192d8d feat(plugins): route quota panels through actions
- 5907be83f feat(plugins): execute codex oauth actions
- 83327c7aa feat(plugins): validate action payload schemas
- c8e304f81 feat(plugins): refresh credentials through actions
- 1ddb64b45 feat(plugins): render action schema forms
- a9fb44bc1 feat(plugins): sanitize action results
- f817fed50 feat(plugins): route resource probes through actions
- df426a455 feat(plugins): validate action result schemas
- 683e31f82 feat(plugins): declare action output schemas
- 71c5ad208 feat(plugins): route quota resets through actions
- d2f74d747 feat(plugins): route image capability through actions
- da6012431 feat(plugins): route provider probes through actions
- d3de24f62 feat(plugins): route provider models through actions
- eca3da0af feat(plugins): derive provider types from plugin data
- 1595defe1 feat(plugins): probe provider health through capabilities
- 32e981665 refactor(plugins): reuse provider health probe dispatch
- 4aeef1309 feat(plugins): preview provider models through actions
- f5fc7ff6c feat(plugins): allow provider catalog preview actions
- a987ebb98 feat(plugins): import submitted models for provider plugins
- 56f314078 feat(plugins): render provider resource panels
- 620a6a44c feat(plugins): validate admin ui schemas
- 88fa56fc7 chore(gitignore): ignore local artifacts
- 8ccb146f4 refactor(plugins): delegate provider admin lifecycle locks
- f46e911e7 refactor(plugins): let providers declare route protocols
- 5ec1a15b4 refactor(plugins): let providers declare header policy
- 51636041b feat(plugins): load provider policies from manifests
- fd0c23540 feat(plugins): expose provider policies to admin ui
- b8e486949 refactor(plugins): validate routes with descriptor policy
- 5aa35f232 feat(plugins): render provider form sections
- 6d4793b07 feat(plugins): support provider catalog ui slot
- 4aaccbfee feat(plugins): render provider catalog cards
- e3795db07 feat(plugins): run context optimize gateway hooks
- 60aab53cc feat(plugins): run request transform gateway hooks
- 78b9f389b feat(plugins): run response post gateway hooks
- 92703c61e feat(plugins): run usage attribution gateway hooks
- 98c9a46c0 feat(plugins): run route candidates gateway hooks
- 6374a1c59 feat(plugins): run guardrail pre gateway hooks
- e04ec1ddb feat(plugins): run guardrail post gateway hooks
- 59696ede1 feat(plugins): run provider call gateway hooks
- 3fe92a130 feat(plugins): run admission gateway hooks
- bca1257c9 feat(plugins): run decode normalize gateway hooks
- 24539179d refactor(plugins): pass request context to route ranking
- 473129b44 feat(plugins): run auth context gateway hooks
- 1eaefe0f2 feat(plugins): run embedding cache gateway hooks
- 4c6d8f677 feat(plugins): run compact cache gateway hooks
- 503294278 feat(plugins): run chat stream transform hooks
- b33ec6540 feat(plugins): run playground stream transform hooks
- 7aee7d873 feat(plugins): run responses stream transform hooks
- 464395a9f feat(plugins): render dashboard admin UI cards
- dd1e135fc feat(plugins): render settings admin UI panels
- 4321ef8bd feat(plugins): render route detail admin UI panels
- d472e8f19 feat(plugins): render admin UI nav pages
- f1c7be851 feat(plugins): stream chat through provider plugins
- 7514f3715 feat(plugins): stream responses through provider plugins
- ddf56b9b3 feat(plugins): generate images through provider plugins
- 3887df19d chore: ignore server image test data
- b707908a9 feat(plugins): compact responses through provider plugins
- 565c04808 feat(plugins): render report template UI contributions
- 1da11645a feat(plugins): render provider panel schema fields
- 81e808257 feat(plugins): run provider resource actions through plugins
- 7a8ed89a8 feat(plugins): renew provider accounts through plugin actions
- c6d983e5d feat(plugins): configure image capability through plugins
- 46e2a75af feat(plugins): read provider account quota through plugins
- 13305dcaf feat(plugins): refresh provider monitor quota through plugins
- 9da898e65 feat(plugins): reset provider account quota through plugins
- d66e47400 feat(plugins): test provider availability through plugins
- 45b8c6810 feat(plugins): declare provider resource types
- 8c3cd9ea8 refactor(plugins): centralize provider resource type traits
- 71e4f5c29 refactor(plugins): extract codex provider profile
- 36621fea5 feat(plugins): expose provider policy capabilities
- 1bef28c10 feat(plugins): hydrate provider form defaults
- 17e7fbed5 feat(plugins): start provider account oauth through actions
- dff03c0a0 feat(plugins): exchange provider oauth through actions
- d924548a4 feat(plugins): run provider form actions
- 56711b95e feat(plugins): validate provider form action controls
- fe7c9e798 feat(plugins): expose all gateway chain stages
- cdbea5226 feat(plugins): expose provider route protocol metadata
- 4878ccd3a feat(plugins): add provider resource form sections
- aa7b106f4 feat(plugins): add background job plane
- 45f1da11f feat(plugins): run background jobs
- 5c21e956a feat(plugins): apply theme token contributions
- c4f1c8e51 feat(plugins): reflect ui schema capabilities
- 703f3a941 feat(plugins): enforce placement contracts
- c403c39e3 feat(plugins): declare provider catalog metadata
- ede986ab5 feat(plugins): label provider types from catalog
- 4ddca352e feat(plugins): declare provider resource metadata
- b61985aa5 feat(plugins): apply resource type metadata
- dfe4f23dd feat(plugins): describe builtin resource metadata
- dbca909ab feat(plugins): persist credential action results
- 82be7b47b feat(plugins): recognize plugin account resources
- f4a2490b0 feat(plugins): preserve plugin account metadata
- ae4594a4a feat(plugins): surface resource type metadata
- 2dcd29003 feat(plugins): probe plugin account resources
- 60565ae30 feat(plugins): refresh plugin account credentials
- 53795806e feat(plugins): pass structured provider credentials
- 6afd490ee feat(plugins): label providers from plugin metadata
- 5a868f1a4 refactor(plugins): centralize provider action execution
- 165a0970b feat(plugins): prefer metadata provider labels
- 077ab768e feat(plugins): label quick catalog from metadata
- 40850fa2a refactor(plugins): reuse provider action paths
- 7793b3ebb fix(plugins): preserve legacy quick catalog labels
- 5ee9b5526 feat(plugins): expose action metadata defaults
- f6d5b40d7 feat(plugins): drive quota reset confirmation from metadata
- 8b8da73cb fix(plugins): use neutral resource defaults
- 2f36bc9dc fix(plugins): generalize account reauthorization copy
- 1c53dc32b fix(plugins): generalize provider quota copy
- 710b1ceab fix(plugins): generalize quota reset copy
- ebdd9b452 refactor(plugins): drive provider resource defaults from metadata
- d4de57d21 refactor(plugins): drive provider oauth redirects from metadata
- 213118f3d refactor(plugins): generalize quota reset confirmation state
- e11429dd9 refactor(plugins): show provider oauth callbacks from metadata
- 023c0c08e refactor(plugins): derive account provider catalogs from plugins
- a2c5ada26 refactor(plugins): preserve account resource type on oauth callback
- 9f91c6645 refactor(plugins): probe account resources through actions
- 97a267003 refactor(plugins): remove codex account fallback copy
- eb543d055 refactor(plugins): rename account catalog flow
- b43521dc1 refactor(plugins): drive image capability display from metadata
- 12d2ce932 refactor(plugins): generalize image capability copy
- 64998faf4 refactor(plugins): drive image capability profile from metadata
- c9c863ec0 refactor(plugins): load account catalogs for plugin providers
- 366b7e9dc refactor(plugins): render model panels from admin ui contributions
- a3772d9e0 refactor(plugins): load plugin catalogs through resource actions
- 7e3d8d81b refactor(plugins): scope resource panels by plugin metadata
- 89b08892d refactor(plugins): require model panel layout metadata
- ea4be9425 refactor(plugins): match resource actions by metadata
- 07214c99d refactor(plugins): drive image routing from plugin profiles
- a016a1578 refactor(plugins): run anthropic preflight gateway hooks
- d5434043e refactor(plugins): run anthropic cache hooks
- 11df3b77b refactor(plugins): transform native anthropic streams
- 70a465d06 refactor(plugins): transform anthropic stream bridges
- 8d7efda23 refactor(plugins): run gemini gateway hooks
- 2eb82ab9a refactor(plugins): run embeddings preflight hooks
- c899e3fc2 refactor(plugins): derive provider type options from descriptors
- 1703bd0ca refactor(plugins): run response job gateway hooks
- e78db4838 refactor(plugins): route image jobs through gateway hooks
- bff222672 refactor(plugins): run image preflight gateway hooks
- 97cc7aa92 refactor(plugins): generalize provider image capability UI
- 0407779d1 refactor(plugins): apply image capability action side effects
- 3bd07fda9 refactor(plugins): reuse image capability route helpers
- 96af1f53d refactor(plugins): metadata-drive image capability state
- 984081ac3 refactor(plugins): drive image capability UI from metadata
- b4c181add refactor(plugins): enforce credential action resource scope
- 8ba42023a refactor(plugins): extract provider resource probe panel
- c9d12b606 refactor(plugins): metadata-drive quota panel copy
- 28e57ec30 refactor(plugins): metadata-drive oauth modal copy
- a07a141b3 refactor(plugins): read image capability details from metadata
- b40223d86 refactor(plugins): honor quota reset action metadata
- 0e45d8ad5 refactor(plugins): generalize account resource copy
- cf67954db refactor(plugins): source account defaults from resource metadata
- a3ca99f4b refactor(plugins): remove codex edit default overrides
- a6c3de22c refactor(plugins): generalize account catalog handling
- bc6bfee14 refactor(plugins): validate image routes from action metadata
- 0c30b1dbf refactor(plugins): clean image capability resources from metadata
- 1ded06692 refactor(plugins): route plugin image models from metadata
- 8bc017789 refactor(plugins): publish plugin image models from metadata
- ce57bc92c refactor(plugins): expose image backfill metadata in admin
- 20c2fb705 refactor(plugins): apply session affinity by capability
- e8a79c782 refactor(plugins): require account resources by type
- 98225df8f refactor(plugins): filter account resource models generically
- 0097fe117 refactor(plugins): query resource model catalogs generically
- 6fb376bf2 refactor(plugins): use account resource helpers in advanced UI
- 6566b61fb refactor(plugins): clean resource model caches generically
- 8a84a8935 refactor(plugins): centralize session affinity kind
- bbdbde696 refactor(plugins): use generic resource model cache keys
- a1c3959e5 refactor(plugins): name resource model matching generically
- 7952ffc20 feat(plugins): expose resource metadata to route hooks
- 7eef897ad refactor(plugins): drive account provider catalog from plugins
- f0d5fbcd4 feat(plugins): add distribution metadata contract
- 774098654 feat(plugins): show distribution metadata in admin
- a3c76062d feat(plugins): support disabled local packages
- ba97e9f57 feat(plugins): add local package state API
- d304e112e feat(plugins): manage local package state in admin
- 796aa5f06 feat(plugins): install verified zip packages
- 3aa9a2268 feat(plugins): add verified install endpoint
- bb59dcd38 feat(plugins): install packages from admin
- 57688052c feat(plugins): update installed packages from admin
- 97d22a3b8 feat(plugins): add marketplace index browsing
- a61825167 feat(plugins): productize plugin directory
- b3d260a3b feat(plugins): uninstall local packages from admin
- bc96b392e fix(gateway): preserve provider-level plugin routes
- 8aeedf844 feat(plugins): run background jobs from admin
- ac1174e33 feat(plugins): declare provider route resource policy
- acb482a74 feat(plugins): declare provider credential scope
- 4810341bb feat(plugins): classify resource credential providers
- 5f22c442b feat(plugins): declare provider session affinity policy
- 8ffdfac1b refactor(plugins): drive compact affinity from provider policy
- 8255665ff refactor(plugins): keep adapter policy defaults generic
- 4a9d17217 refactor(plugins): trust adapter header policy
- 826f2984f refactor(plugins): route compatibility bridges by protocol
- 3b7faa438 docs(plugins): document codex responses route protocol
- 8b58b3801 refactor(plugins): reconcile provider policies from adapters
- 6ad387fdc refactor(plugins): require explicit provider policy options
- 6ac76cdf7 refactor(plugins): require route protocol descriptors
- 34acd86b7 refactor(plugins): move codex fingerprint UI to plugin
- 29aad3bf3 refactor(plugins): expose gemini models by route protocol
- 5cbc200f6 refactor(plugins): default header policy from adapters
- 99b48e33d refactor(plugins): derive header UI policy from descriptors
- 217d8862d refactor(plugins): route playground codex by protocol
- d1553b726 refactor(plugins): derive session errors from affinity kind
- 4bde7145a refactor(plugins): filter image routes by capability
- 354abd8a1 refactor(plugins): share resource model cache catalog
- e0b28205e refactor(plugins): skip profiled image routes generically
- 4233509fa refactor(plugins): derive reasoning UI from route protocols
- de4993264 refactor(plugins): classify account providers from adapters
- 7926151f1 refactor(plugins): expose provider resource types on adapters
- 265f7e961 refactor(plugins): apply provider defaults from adapters
- ec824172b refactor(plugins): run openai images through adapter
- f0e83803e refactor(plugins): route catalog previews by entry type
- 9d21e192b refactor(plugins): expose provider auth modes
- 2dbca1e16 refactor(plugins): validate provider auth modes from adapters
- 348288834 refactor(plugins): default provider auth mode from adapters
- 022e2b43b refactor(plugins): initialize provider auth mode from adapters
- dd44e9925 refactor(plugins): default attribution policy from adapters
- 8a7f2d30f refactor(plugins): use catalog metadata for resource model cache
- 0290df7e0 refactor(plugins): make provider auth mode UI generic
- 219c49dd7 refactor(plugins): drive codex image profile from action metadata
- 7adbea9ff refactor(plugins): qualify quota reset resources from action metadata
- 4cc7f6f4b refactor(plugins): derive provider auth mode generically
- 5a5db3577 refactor(plugins): persist provider auth modes from descriptors
- e294818f6 refactor(plugins): honor explicit provider catalog types
- 06f4ff0d8 refactor(plugins): accept manifest provider catalog URLs
- 3b007c0e4 refactor(plugins): merge declared built-in provider catalogs
- d42559c9a refactor(plugins): declare codex catalog in provider plugin
- b66dc6370 refactor(plugins): derive codex catalog metadata from plugin descriptor
- f18157f89 refactor(plugins): preview provider catalogs through plugin actions
- f107df32b refactor(plugins): remove static account provider catalog fallback
- 279873392 refactor(plugins): backfill image routes from plugin profiles
- 5bc888c1e refactor(plugins): run playground chat through preflight hooks
- 0f31cbbb4 refactor(plugins): apply route candidate hooks in playground
- f9417348d refactor(plugins): merge builtin provider catalog metadata
- 4cf5d8ca7 refactor(plugins): apply resource defaults from provider descriptors
- 29415d25b refactor(plugins): honor resource descriptor defaults
- 1abc81896 refactor(plugins): persist plugin credential reauthorization state
- be7ff1b1d refactor(plugins): avoid default oauth in resource payloads
- 53d59d733 refactor(plugins): keep account auth forms metadata-driven
- d927f00c9 refactor(plugins): preview kronk catalogs through plugin action
- 7b744a233 refactor(plugins): derive provider auth modes from metadata
- cb6253800 refactor(plugins): source attribution defaults from descriptors
- e92fa3947 refactor(plugins): derive attribution defaults from metadata
- eef221be0 refactor(plugins): describe attribution policy as plugin metadata
- 62580b915 refactor(plugins): drive model discovery from provider policy
- 75120457d refactor(plugins): require declared provider auth modes
- c0bab4bed refactor(plugins): expose model discovery metadata in admin
- 0d1bc5842 refactor(plugins): expose provider default base urls
- c47d00537 refactor(plugins): stop inferring builtin base urls in core
- 80a5c1792 refactor(plugins): derive provider reasoning UI from metadata
- d39100411 refactor(plugins): label provider types from metadata
- 65e16c3b8 refactor(plugins): source header policy from descriptors
- 3d6c84617 refactor(plugins): source route protocols from descriptors
- c6d1d6473 refactor(plugins): derive catalog provider types from metadata
- 8536bf486 refactor(plugins): remove kronk catalog url fallback
- bf9c9e750 refactor(plugins): route catalog previews through provider actions
- 82dc4915c refactor(plugins): declare provider error profiles
- 68dba236d chore(plugins): type provider error profiles in admin
- e90f157a8 refactor(plugins): derive catalog preview routes
- a6b7d21b8 refactor(plugins): default provider type from metadata
- cc44db38c refactor(plugins): drive provider previews from actions
- 16abc3877 refactor(plugins): declare provider API key policy
- 88d172470 refactor(plugins): render provider key policy in admin
- 81484b733 refactor(plugins): detect account resources from metadata
- c8fe7072f refactor(plugins): classify provider resources by policy
- a81b16e84 refactor(plugins): filter account routes by resource policy
- 2184372d9 refactor(plugins): gate image account locks by resource policy
- eed6d491a refactor(plugins): hide account resources by metadata
- a062cd467 refactor(plugins): categorize account providers from metadata
- af40a7e80 refactor(plugins): apply provider error profiles from policy
- c43a676b6 refactor(plugins): apply provider defaults from policy
- c03c51a02 refactor(plugins): select catalog resources from metadata
- 65f354f64 refactor(plugins): drive credential refresh by policy
- 87ef447ac test(plugins): cover credential refresh policy persistence
- 746c95a50 refactor(plugins): remove unused OpenAI account UI helpers
- 1daeb34bb refactor(plugins): match resource actions by metadata
- f6e193a7d refactor(plugins): select probe actions by resource type
- 4038cbe58 refactor(plugins): select quota and image actions by resource
- e68069784 refactor(plugins): require refresh profile policy
- 77910c8d8 refactor(plugins): use resource metadata defaults only
- fa2d7bbf6 refactor(plugins): declare credential identity profiles
- 72943d038 refactor(plugins): declare optional resource credentials
- 1033a52e1 refactor(plugins): protect resource options through profiles
- 111de963a refactor(plugins): route provider probes through actions
- 5540a5263 refactor(plugins): keep error profiles policy driven
- 7bd50e789 refactor(plugins): expose resource credential metadata
- 23f4aeae2 refactor(plugins): derive cached catalog identity from metadata
- 041dd22f0 refactor(plugins): generalize account model filtering errors
- 577de4535 refactor(plugins): prepare routes by refresh policy
- f0ccd75b0 refactor(plugins): use metadata provider defaults only
- e678cfa3f refactor(plugins): gate resource models by metadata
- f45eb917c refactor(plugins): require quota reset actions
- a7eec0b0a refactor(plugins): select account actions by resource
- bd51ea4d8 refactor(plugins): require image capability actions
- 57fe3c734 refactor(plugins): derive image locks from profiles
- 73216bcde refactor(plugins): match quotas by resource action
- 6988c01ca refactor(plugins): require image profile metadata in UI
- 1bdc13338 refactor(plugins): preserve current resource types generically
- 820ae6d38 refactor(plugins): order resource types by metadata
- a06f95069 refactor(plugins): require image capability profiles
- b4d6f2223 refactor(plugins): use provider neutral credential sources
- 40b6fcd1f refactor(plugins): keep provider discovery order
- 5aacc9054 refactor(plugins): scope resource defaults by provider
- 4f64cbe5e refactor(plugins): sync image profiles from actions
- ec805ce6e refactor(plugins): require explicit image profile configuration
- b426390f9 refactor(plugins): persist plugin resource model catalogs
- 57af448aa refactor(plugins): prefer exact resource actions
- 429272712 refactor(plugins): wire image routes through gateway hooks
- 8d84efe87 refactor(plugins): require chain registration for hooks
- a91870241 refactor(plugins): accept plugin image models in gateway
- 32537979a refactor(plugins): decouple image routing metadata from ui
- 9ad044a6b refactor(plugins): scope gateway hooks by subject
- 7d35b35ea refactor(plugins): seed provider catalog from plugins
- aea9eb442 refactor(plugins): scope provider call hooks by protocol
- c3927d11d refactor(plugins): derive provider ui policy from manifests
- 01dadbc60 refactor(plugins): read provider labels from plugin catalog
- 2d605a597 refactor(plugins): bootstrap provider catalog from plugins
- 10bd95634 refactor(plugins): support catalog-only provider plugins
- 93cf953d2 refactor(plugins): derive builtin catalog from plugin seeds
- 462c3da79 refactor(plugins): scope request transform hooks by protocol
- 76b09daeb refactor(plugins): scope route post hooks by protocol
- acfce82bf refactor(plugins): map provider action errors from metadata
- 34190b4b6 refactor(plugins): default provider forms from plugin types
- 386562736 refactor(plugins): read image action errors from metadata
- b7bf8a4c5 refactor(plugins): drive quick provider labels from type options
- 0fd17f92e refactor(plugins): avoid legacy defaults in provider sections
- aa979022a refactor(plugins): keep provider type fallback internal
- c6b5ad6fd refactor(plugins): remove frontend codex profile constants
- 6e2601221 refactor(plugins): declare default catalog provider type
- e2f76f5dc refactor(plugins): expose default provider type policy
- f60db27e6 refactor(plugins): seed custom catalog from plugin default
- 0987f4d76 refactor(plugins): use catalog default for provider creation
- ce6e64ea0 refactor(plugins): read image route errors from metadata
- c7000bb5e refactor(plugins): drive image capability endpoint metadata from actions
- 92d6f5029 refactor(plugins): make image capability locks profile driven
- fb174bf70 refactor(plugins): read image probe errors from metadata
- c56368a98 refactor(plugins): read image capability fallback from metadata
- 1775a4119 refactor(plugins): use generic image capability defaults
- 65e2c2e70 refactor(plugins): drive image capability probe request from metadata
- f8a85b433 refactor(plugins): route codex image generation through adapter
- 7dfec0f83 refactor(plugins): remove legacy codex image runner
- 14e55845f refactor(plugins): drive image request aliases from metadata
- f164d57c3 refactor(plugins): read default image model from metadata
- 370c61b36 refactor(plugins): read image mask support from metadata
- 8ea0946c1 refactor(plugins): read image size policy from metadata
- 0d92fd45d refactor(plugins): read image quality policy from metadata
- 75e023a96 refactor(plugins): move codex image model metadata ownership
- 343dc9394 refactor(plugins): expose image request policy in admin profile
- d5e5c2c31 refactor(plugins): read image response formats from metadata
- a8278bef1 refactor(plugins): read image output count from metadata
- 3f84b5102 refactor(plugins): derive provider type options from descriptors
- 78ac42904 refactor(plugins): derive provider labels from descriptors
- a6c6d4fad refactor(plugins): generalize provider account UI names
- cd210008f refactor(plugins): remove legacy codex quota labels
- 7a6ded4a3 refactor(plugins): source catalog default type from plugins
- 571c0d093 refactor(plugins): drive reasoning content policy from providers
- 69d7d92c9 refactor(plugins): scope responses models through provider policy
- 1c05b3b51 refactor(plugins): drive auth mode errors from provider policy
- f6360a4d0 refactor(plugins): read cache price estimates from model metadata
- 56e272eef refactor(plugins): declare legacy auth options in provider policy
- 83552e93d refactor(plugins): remove codex affinity wrapper helpers
- 44eebe37b refactor(plugins): categorize providers from catalog metadata
- bcf5530b1 refactor(plugins): preserve catalog model categories
- caf97a721 refactor(plugins): derive model categories from provider metadata
- 539a65512 refactor(plugins): use generic provider auth mode
- 0a2029596 refactor(plugins): declare provider reasoning policy
- 99670071f refactor(plugins): describe cache pricing metadata policy
- 744e56d38 refactor(plugins): generalize system prompt transform policy
- 07a75b4ad refactor(plugins): require declared provider resource types
- 8eb4088be refactor(plugins): route provider OAuth through actions
- 3cf2492ef refactor(plugins): schedule provider maintenance jobs
- 7bb9a02a0 refactor(plugins): route provider model discovery through actions
- e936478ad refactor(plugins): describe provider error profiles
- 13b827e61 refactor(plugins): generalize provider catalog creation
- b88e875d0 refactor(admin-ui): render provider advanced fields declaratively
- 55ced299c refactor(admin-ui): route provider resource panels through contributions
- f27e2af4d refactor(admin-ui): centralize plugin page registry
- bf4d14e78 refactor(admin-ui): add sim capability registry
- 9bace8c21 refactor(plugins): define sim package schema
- 216c9333b refactor(admin-ui): add sim presentation resolver
- f972ddac7 refactor(admin-ui): wire sim registry into shell presentation
- b6803eb9b refactor(admin-ui): add dashboard composition registry
- 8daeb7eb9 refactor(admin-ui): add page template registry
- 3007fe033 refactor(plugins): define plugin api contract
- 0604a83f7 refactor(plugins): add plugin trust policy contract
- 583579f02 refactor(plugins): add plugin lifecycle states
- 0c2ee6201 refactor(plugins): expose admin plugin lifecycle metadata
- 3547419bd refactor(plugins): define gateway stage order
- 448011eae refactor(plugins): define gateway envelope contract
- d1962e9b3 refactor(plugins): define gateway hook policy
- 0eb8da2b1 refactor(plugins): add gateway hook audit propagation
- e197c7ab0 test(plugins): cover gateway admission hook audit events
- c7afed167 refactor(plugins): split gateway hook stage files
- fc43a2411 refactor(plugins): align gateway endpoint hook order
- 3810cdbd2 refactor(plugins): scope gateway privacy hooks
- 5e329bd71 refactor(admin-ui): derive plugin manager lifecycle state
- 97bed652e refactor(plugins): add marketplace manifest metadata
- 8b5c98ee8 test(plugins): cover gateway context hook boundaries
- 3bbd5184f refactor(plugins): expose safe marketplace metadata
- 989ccfac8 refactor(admin-ui): resolve active sim selection
- 646588413 refactor(plugins): describe builtin provider packages
- 386554d07 refactor(plugins): extract server plugin bootstrap
- 6c266b793 refactor(plugins): move builtin provider runtime construction
- f0d93d7d3 refactor(plugins): route probe fallback through provider policy
- dff46f16a refactor(plugins): select response affinity by provider policy
- 09fe19552 refactor(plugins): enforce admin ui action bindings
- 85f871ea2 refactor(admin-ui): type plugin marketplace metadata
- 7a2937a8f refactor(admin-ui): normalize plugin marketplace display
- 14b2fff70 refactor(admin-ui): extract plugin action domain helpers
- ecd11e8db refactor(admin-ui): extract plugin action runner
- ca822c3ae refactor(admin-ui): consume shared plugin runners
- 5d5565900 refactor(admin-ui): render plugin marketplace metadata
- 969488914 refactor(admin-ui): render plugin lifecycle state
- e99ab0258 refactor(admin-ui): consume plugin page actions through runner
- 042413042 refactor(admin-ui): consume provider panel actions through runner
- af4427c2e refactor(admin-ui): wire sim selection into shell presentation
- 9262969f1 refactor(admin-ui): add sim selection manager
- 4f016ae92 refactor(plugins): add provider command contract
- bf0fe2e9f refactor(plugins): narrow provider command projection
- 06f2e1a58 refactor(plugins): centralize provider command runtime seam
- e31b493b8 refactor(plugins): resolve native anthropic adapter by provider
- 8f635f25c refactor(plugins): harden codex provider descriptor
- ce6926306 refactor(plugins): route codex oauth aliases through actions
- 8aa6cbfd9 refactor(plugins): persist quota action snapshots
- a2f45edeb refactor(plugins): route provider bridges by protocol
- 8351e2036 refactor(plugins): sanitize admin action payloads
- a064e935e refactor(admin-ui): render quota panels from plugin metadata
- b564925cf test(plugins): guard generic core provider hardcoding
- aa067e876 test(plugins): harden gateway cache hook coverage
- 98a6cbbef test(plugins): prove request transform attempt isolation
- 57191302a test(plugins): harden response transform hook coverage
- 404b56c69 test(plugins): harden background response transform hooks
- db0e7f08d test(plugins): harden response guardrail hook coverage
- 5306867f4 test(plugins): harden stream transform hook coverage
- b0903a713 test(plugins): add minimal core boundary gate
- 918febc45 test(plugins): harden trace export hook coverage
- 6aa9cc0b3 test(server): stop response workers after store close
- 0364ac595 test(plugins): harden gateway failover hook coverage
- d550d151f feat(plugins): add marketplace index validator
- 71867d92a refactor(plugins): centralize stdio command runtime
- 7de2ce454 test(plugins): add external mock provider contract
- 396fc69a7 test(plugins): add external trace hook contract
- c7f4453b8 feat(plugins): verify signed marketplace artifacts
- 6474706a7 refactor(admin-ui): style sim plugin surfaces
- 04d5cde52 feat(plugins): consume marketplace channel indexes
- cd83816c8 feat(plugins): verify marketplace install signatures
- 3b9ae56ab feat(plugins): persist install lifecycle state
- 118427749 feat(plugins): persist admin state transitions
- 7c78d86a2 refactor(admin-ui): add plugin manager css hooks
- ce74b2dc8 feat(plugins): add provider plugin contract kit
- abcb7a518 feat(plugins): add action plugin contract kit
- daa117413 feat(plugins): add gateway hook contract kit
- 17616044b feat(plugins): add background job contract kit
- f84ae12a9 refactor(admin-ui): style marketplace plugin details
- f8b29f8c6 feat(plugins): add permission runtime contract
- 24add2e73 feat(plugins): enforce command permissions
- 4c32b5c53 feat(plugins): add package rollback endpoint
- e4fd91d70 feat(plugins): preview permission changes
- 17932475a feat(plugins): sandbox command environments
- 881581e16 feat(admin-ui): add plugin permission diff domain
- 7aeb08da0 feat(admin-ui): preview plugin permission changes
- 6099bb827 feat(plugins): add background scheduler state
- 10325890f feat(plugins): harden background job retries
- 8f4de5c42 feat(plugins): cancel background jobs on shutdown
- cbe717621 refactor(plugins): audit background jobs with correlation ids
- 26cc9a46e feat(admin-ui): add plugin rollback action
- 27a534dbe feat(plugins): redact background job secrets
- 2bf9d1d88 test(plugins): pin provider id migration mapping
- df914e8cd test(plugins): preserve legacy route selection
- 1c7685344 test(plugins): preserve legacy resource migration
- 62894cf5b test(plugins): preserve quota migration
- 3af251e80 test(plugins): preserve usage audit migration
- f27a18c7d test(plugins): preserve dual-read compatibility
- 5f9028fe9 fix(server): normalize legacy provider aliases
- 939db7ef3 fix(frontend): normalize legacy provider aliases
- 16ab1c94e feat(plugins): quarantine failed package startup
- 49db9b03a feat(plugins): expose built-in fallback rollback
- 5dc0a65df feat(admin-ui): surface startup fallback rollback state
- 1288aadd2 test(plugins): cover external guardrail provider samples
- ed5af9582 test(plugins): guard core endpoint storage boundaries
- 838ff683f refactor(plugins): use provider error disposition for cleanup
- 8226c112b feat(plugins): report sandbox process enforcement
- 7726d241b refactor(plugins): unify codex provider runtime registration
- c5aa1e10e refactor(admin-ui): derive provider categories from metadata
- c3c1f00e7 refactor(plugins): resolve codex adapter through registry
- 288c57f07 refactor(plugins): remove codex server adapter field
- dd165ac55 refactor(plugins): configure provider adapters generically
- d042ba06e refactor(plugins): isolate builtin provider runtime
- d519d9e53 refactor(plugins): isolate builtin provider catalog seeds
- c6d019d9d refactor(plugins): generalize provider catalog discovery auth
- 94fcba3dd refactor(plugins): isolate catalog URL normalization
- 932621a17 refactor(plugins): isolate codex model catalog runtime
- 237128ece refactor(plugins): isolate codex model cache aliases
- e15980e5c refactor(admin-ui): require provider oauth plugin actions
- 5d1b2f444 refactor(plugins): isolate protocol gateway patchers
- 3ffc9f821 refactor(admin-ui): derive provider resource base urls from metadata
- 3e66cb23a refactor(plugins): isolate legacy codex adapter migration
- e4630d0f0 refactor(plugins): register codex route bridge separately
- a9b01fa9a refactor(plugins): register provider credential refresh handlers
- 8ae7a2abd refactor(plugins): register credential identity profiles
- 9f2272961 refactor(plugins): generalize quota reset action results
- e5a4039c9 refactor(plugins): drive session affinity identifiers from policy
- 855476cbc refactor(plugins): move model category defaults to builtin catalog
- d6e0a3927 refactor(plugins): require explicit catalog metadata
- c7378e7de refactor(plugins): declare provider managed headers
- 2a6bbae11 refactor(admin-ui): stop synthesizing provider type defaults
- 6cd5b054f refactor(admin-ui): derive model categories from metadata
- e14a10b5a refactor(admin-ui): generalize provider quota display
- ef76e809b refactor(admin-ui): honor plugin managed provider headers
- ab3a9703b refactor(admin-ui): load identity templates from plugins
- 55562a879 refactor(admin-ui): read quota reset compatibility from plugins
- 1cffc5991 refactor(server): monitor quota via plugin actions
- 0cc9c50ad refactor(frontend): remove legacy openai fallback defaults
- 03b9185de refactor(admin-ui): make notification templates explicit
- 25cf90214 refactor(admin): extract project key metadata
- 101715f13 refactor(provider): require explicit custom catalog type
- 9632d2798 refactor(provider): move openai refresh profile boundary
- 62ba907c4 refactor(admin): neutralize quota handler names
- cc9c733f4 docs(plugins): add plugin development guide
- 6b5806379 feat(admin-ui): organize plugin management tabs
- 5366757ca feat(admin-ui): support plugin zip uploads
- b682272bf fix(admin-ui): avoid plugin install input reuse
- ea72d4fa5 test(admin-ui): cover marketplace tab rendering
- c15a8acc7 feat(admin-ui): install local plugins from dialog
- a401e17e7 feat(admin-ui): localize plugin metadata
- 0e03aebfe fix(ui): polish plugin install modal
- 5b428dd08 fix(ui): remove marketplace tab and rename sim labels
- ba7ac03fb refactor(admin): reshape plugin management and docs
- 9ee965dbe docs: link plugin development guide
- 0a8e30a8d fix(admin): clarify plugin manager metrics
- c8fbf1140 fix(admin): simplify interface template tab
- 6bae26950 feat(admin): register default interface template plugin
- 67819da82 feat(admin): add antd interface template plugin
- 1f2cd436e feat(admin): simplify ui template selection
- 8bcd4c80f feat(admin): add provider plugin tab
- b7d9e6eab fix(admin): allow built-in provider plugin toggles
- cc5aaff5e feat(admin): add knowledge sidebar template plugin
- 196f11045 fix(admin): persist built-in provider plugin state
- c87127cfd fix(admin): list gateway injection plugins
- a4d82f420 fix(admin): group background job plugins
- 5b55f88d2 fix(frontend): tidy plugin title cells
- 61d4d90bf fix(server): hot reload plugins without restart
- 1490100e7 feat(admin): add configurable plugin management pages
- 689f468a6 docs: update plugin architecture overview
- 76c573807 fix(ci): align plugin migration checks and postgres fixtures
- 3ea9b34bc Merge pull request #305 from astaxie/codex/docs-plugin-architecture-20260905
- 5a1a289e5 refactor(plugins): separate devkit from marketplace
- 432139728 fix(provider): show blocked IPs and network configuration guidance
- 4d871746f Merge pull request #307 from astaxie/codex/fix-provider-network-diagnostics
- 8362bf5f8 fix(admin): resolve plugin management findings from live testing
- 85c60318a Merge pull request #306 from astaxie/fix/plugin-management-test-findings
- 076a1b2d5 feat(admin): simplify plugin details and settings
- 46f31f926 feat(provider): allow self-hosted models without network opt-in
- 717aa0577 fix(provider): close local upstream review gaps
- 4586d7159 Merge pull request #308 from astaxie/codex/allow-self-hosted-model-http
- 40cd76ed4 feat(admin): streamline plugin management controls
- 8e0d44828 fix(plugins): clear applied restart markers
- 64967f307 fix(admin): align plugin row actions
- a545c5a63 style(admin): unify installed plugin rows
- db3459ec2 fix(admin): explain plugin capabilities clearly
- b13bbaf12 fix(admin): hide unavailable plugin files
- 8c00d24d2 fix(admin): polish empty plugin state
- dc8de1d69 feat(plugins): connect provider catalog to plugin manager
- fdb197340 feat(billing): add time and cache pricing with shadow evidence
- 8a016bfad Merge remote-tracking branch 'origin/codex/plugin-legacy-migration-boundary-001' into codex/billing-time-cache
- d664d9e18 fix(billing): validate prices and verify expanded schema
- 3d5a00069 test(billing): check database cleanup errors
- c03cec314 Merge pull request #310 from astaxie/codex/billing-time-cache
- 4193b8a4c Merge remote-tracking branch 'origin/codex/plugin-legacy-migration-boundary-001' into codex/plugin-legacy-migration-boundary-001
- 485077637 fix(plugins): keep template plugin names in English
- 08fa709fe feat(plugins): overhaul plugin management and API v2
- b83a8c21b fix(plugins): correct lifecycle and management layout
- e5ab82e9a fix(i18n): localize built-in plugin UI and admin copy
- 5dd91198f fix(ci): remove unused legacy plugin helpers
- 5d49a5f45 feat(billing): add upstream and customer cost statements
- 5f3bcfb30 fix(i18n): translate statement amount heading
- d5a737d04 test(plugins): align template naming assertions with canonical names
- 756ce7aff merge: integrate latest plugin migration target
- e1e14a417 fix(plugins): remove obsolete migration helpers and align CI checks
- d9af7a874 Merge pull request #312 from astaxie/codex/billing-statements
- 05e214367 merge: integrate latest plugin migration target
- 0e0031bb5 Merge pull request #313 from astaxie/codex/fix-plugin-ui-localization
- 383388c6e Merge remote-tracking branch 'origin/codex/plugin-legacy-migration-boundary-001' into codex/plugin-legacy-migration-boundary-001
- e175bc9fe fix(i18n): reuse translated plugin action error
- bf2e5ba89 fix(plugins): address copilot review findings
- 570668207 fix(plugins): address lifecycle review findings
- d96fe3376 fix(plugins): address follow-up review findings
- da6be6caa fix(plugins): quarantine external command packages
- 78f9c73e7 fix(plugins): preserve quarantine lifecycle boundaries
- a519d6d56 fix(plugins): reconcile quarantined fallback state
- c1ed142bb feat(models): add gpt-6-astra support
- 4e92f11b1 Merge pull request #317 from astaxie/codex/add-gpt-6-astra
- f522b1582 fix(plugins): preserve operational rollback state
- ea691abf1 fix(sim): project active plugin kinds
- 3feda3af8 fix(sim): expose active plugin kinds
- eef1222ff fix(sim): preserve legacy active kinds
- 334348223 test(ui): add database-free acceptance scenarios and gallery
- 9754c9c3d test(ui): tighten request assertions and capture metadata
- c88b03a2c fix(ui): capture mobile acceptance screens in viewport segments
- 22f86a43e Merge pull request #318 from astaxie/codex/ui-acceptance-fixtures
- e3ff5483f fix(plugins): address remaining review findings
- b9d1f87d8 fix(plugins): update marketplace URL
- a98b57584 fix(plugins): address gateway marketplace and billing reviews
- 980f3f803 test(plugins): make marketplace release coverage platform independent
- a5a22115e fix(plugins): address gateway lifecycle and billing reviews
- 9c2783bb2 fix(plugins): honor request scope in provider capabilities
- 5940f6938 fix(gateway): enforce scoped admission and provider output modes
- 5eee96af6 docs(gateway): clarify stream mode admission semantics
- bd26c7d16 fix: close remaining PR review gaps
- 333f4e56d fix(plugins): preserve updates and honor disabled lifecycle
- 5e80c8fc7 Merge pull request #315 from astaxie/codex/plugin-legacy-migration-boundary-001
- 6513e8d0b chore(release): prepare v0.8.0
- 3b350a699 test(migration): use the compose mock upstream
- c8e8e5f33 Merge pull request #327 from astaxie/codex/release-v0.8.0
Release commit: c8e8e5f
Full Changelog: v0.7.0...v0.8.0