Repository navigation
feat(proxy): surface anonymous egress-IP sharing in the health sweep and the egress API - #10876
Merged
diegosouzapw merged 1 commit intoAug 20, 2026
Conversation
…and the egress API
maxmad64bis
force-pushed
the
feat/10677-egress-sharing-summary
branch
from
August 20, 2026 17:20
fce910d to
2b66a11
Compare
muhamadgalihsaputra
pushed a commit
to niyatna/NiyatnaRoute
that referenced
this pull request
Sep 27, 2026
…and the egress API (diegosouzapw#10876) Obrigado — expõe onde o operador realmente olha (sweep periódico de saúde de proxy + resposta da API de egress) o sinal de compartilhamento anônimo de IP de egress entre contas de um mesmo rotation group, que já existia (analyzeEgressSharing) mas só era acessível via curl autenticado. Fecha diegosouzapw#10677. Respeita a decisão de redação do diegosouzapw#10348/diegosouzapw#10539: apenas contagens por padrão, nenhum IP/identidade de conta a menos que PROXY_LOG_INCLUDE_IPS=true. Validação (worktree combinado a partir de origin/release/v3.8.50, 0 conflitos): - typecheck:core limpo, complexity/cognitive-complexity dentro do baseline - tests/unit/proxy-egress-route-summary.test.ts + proxy-egress-summary.test.ts + proxy-health-egress-line.test.ts — 23/23 passando (agregado, formatter, linha do sweep com output real capturado, rota completa com auth de management)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
When several accounts of the same rotation group exit through one egress IP,
the provider can revoke them all at once — the situation behind codex anomaly
revocations. OmniRoute already detects it (
analyzeEgressSharing), but onlybehind a management-authenticated curl. This PR surfaces the signal where
operators actually look: the periodic proxy-health sweep and the egress API
response, as counts only.
Related Issues
Closes #10677. Respects the redaction decision from #10348 (merged via #10539):
no IP literals and no account identities by default;
PROXY_LOG_INCLUDE_IPS=trueremains the only raw-detail opt-in.
Validation
npm run lintTests Added Or Updated
tests/unit/proxy-egress-summary.test.ts(pure aggregate, 6 cases),tests/unit/proxy-health-egress-line.test.ts(sweep line, anonymous + opt-in),tests/unit/proxy-egress-route-summary.test.ts(additive API summary, auth).All green; lint clean.
Coverage Notes
The pure function and the formatter are covered directly. The sweep line is
proven by capturing console output of a real forced sweep. The route test
exercises the full auth path with a management key.
Reviewer Notes
The aggregate reuses
analyzeEgressSharing— same rotation-group semantics asthe existing diagnostic, no new taxonomy. The rolling window is a fixed 24h.
The summary helper reads persisted
proxy_logs(zero new SQL); a DB hiccup onthe sweep's summary is caught and logged without failing the sweep.