ldrouter 1.16.2 → 1.16.3

package/dist/server/gateway/runner.js

@@ -3,15 +3,13 @@ import { getDb, schema } from '../db/index.js';
 import { eq } from 'drizzle-orm';
 import { GatewayError } from '../errors.js';
 import { resolveRequestedModel, unwrapAlias } from '../routing/resolver.js';
-import { deriveRequiredCapabilities, modelMeets } from '../routing/capabilities.js';
-import { loadCombo, selectCandidates, orderCandidates, shouldFallback, expandCodexAccountCandidates } from '../routing/combo.js';
-import { listCodexAccountsForProvider, setCodexAccountHealth } from '../db/repositories/codex-accounts.js';
+import { bareModelName, deriveRequiredCapabilities, describeRejections, firstMissingCapability } from '../routing/capabilities.js';
+import { loadCombo, selectCandidates, orderCandidates, shouldFallback } from '../routing/combo.js';
 import { getEffectiveState, isOpen, recordSuccess, recordFailure, halfOpenProbeAllowed } from '../routing/circuit.js';
 import { checkRpm, checkTpm, acquireConcurrent, releaseConcurrent } from '../routing/ratelimit.js';
 import { checkDailyMonthly, consumeUsage } from '../routing/quota.js';
 import { keyAllowedFor } from '../auth/api-key.js';
-import { providerToUpstreamConfig, callUpstreamNonStreaming, callUpstreamStreaming, upstreamUrl } from '../upstream/client.js';
-import { callCodexNonStreaming, callCodexStreaming } from '../providers/codex.js';
+import { providerToUpstreamConfig, callUpstreamNonStreaming, callUpstreamStreaming, upstreamUrl, upstreamHttpError } from '../upstream/client.js';
 import { canonicalToOpenAIRequest, openAIResponseToCanonical } from '../protocols/canonical.js';
 import { canonicalToAnthropicRequest, anthropicResponseToCanonical } from '../protocols/anthropic.js';
 import { uuid } from '../auth/ids.js';
@@ -100,21 +98,22 @@ export class GatewayRunner {
             ]);
             // --- Determine candidates ---
             let candidates = [];
-            let selectionReasons = [];
+            const selectionReasons = [];
+            const rejected = [];
             if (resolved.kind === 'model') {
-                candidates = await this.loadModelCandidate(resolved.modelId, required, ctx.requestId);
+                const loaded = await this.loadModelCandidate(resolved.modelId, required, ctx.requestId);
+                candidates = loaded.candidates;
+                rejected.push(...loaded.rejected);
                 selectionReasons.push('direct_model');
-                if (candidates.length === 0) {
-                    debugHttp(ctx.requestId, 'CAPABILITY REJECT', [
-                        `model=${resolved.publicModelId}`,
-                        `reason=direct_model_unavailable_or_capability_mismatch`,
-                        '(direct model candidates rejected: not found / provider disabled / model disabled / upstream unavailable / circuit open / capability mismatch)',
-                    ]);
-                }
             }
             else if (comboPlan) {
+                // A disabled combo is a configuration decision, not a routing failure:
+                // say so instead of blaming its members for not being available.
+                if (!resolved.enabled) {
+                    const s = describeRejections({ kind: 'combo', publicModelId: resolved.publicModelId }, [{ publicModelId: resolved.publicModelId, reason: 'combo_disabled' }]);
+                    throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
+                }
                 const all = await this.loadAllModels();
-                const rejected = [];
                 const filtered = selectCandidates(comboPlan, all, required, (c, reason) => {
                     rejected.push({ publicModelId: c.publicModelId, reason });
                     debugHttp(ctx.requestId, 'CAPABILITY REJECT', [`model=${c.publicModelId}`, `reason=${reason}`]);
@@ -127,12 +126,10 @@ export class GatewayRunner {
                     ...rejected.map((r) => `rejected: ${r.publicModelId} reason=${r.reason}`),
                 ]);
                 if (filtered.length === 0) {
-                    throw new GatewayError('capability_not_supported', 'No combo member satisfies the request capabilities or availability', { status: 400 });
+                    const s = describeRejections({ kind: 'combo', publicModelId: resolved.publicModelId }, rejected);
+                    throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
                 }
-                candidates = orderCandidates(comboPlan, filtered).flatMap((candidate) => {
-                    const provider = getDb().select().from(schema.providers).where(eq(schema.providers.id, candidate.providerId)).get();
-                    return provider?.type === 'codex' ? expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(provider.id)) : [candidate];
-                });
+                candidates = orderCandidates(comboPlan, filtered);
                 debugHttp(ctx.requestId, 'CANDIDATES ORDERED', [
                     `mode=${comboPlan.mode}`,
                     ...candidates.map((c, i) => `candidate[${i}]: providerModelId=${c.modelId} publicModelId=${c.publicModelId}`),
@@ -140,7 +137,8 @@ export class GatewayRunner {
                 selectionReasons.push('combo');
             }
             if (candidates.length === 0) {
-                throw new GatewayError('upstream_unavailable', 'No available model candidates', { status: 502 });
+                const s = describeRejections({ kind: 'model', publicModelId: resolved.publicModelId }, rejected);
+                throw new GatewayError(s.type, s.message, { status: s.status, code: s.type });
             }
             // --- Gateway response cache check ---
             const settings = getSettings();
@@ -201,7 +199,7 @@ export class GatewayRunner {
                     lastError = new GatewayError('upstream_unavailable', 'Provider circuit is open', { status: 502 });
                     break;
                 }
-                const cfg = providerToUpstreamConfig(provider, candidate.codexAccountId);
+                const cfg = providerToUpstreamConfig(provider);
                 const attemptStart = Date.now();
                 // docs/13 §11–§12: provider/account + upstream request summary
                 const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
@@ -214,7 +212,7 @@ export class GatewayRunner {
                     `upstreamType=${cfg.type}`,
                     `baseUrl=${cfg.baseUrl}`,
                     `stream=${req.canonical.stream}`,
-                    `providerKeyFingerprint=${apiKeyFingerprint(cfg.apiKey ?? '')}`,
+                    `providerKeyFingerprint=${apiKeyFingerprint(cfg.apiKey)}`,
                 ]);
                 const attempt = {
                     attemptNumber: i + 1,
@@ -230,8 +228,7 @@ export class GatewayRunner {
                     usage: { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, total: 0 },
                     streamStarted: false,
                     partialResponse: false,
-                    selectionReason: candidate.selectionReason ?? selectionReasons[0] ?? 'direct',
-                    codexAccountId: candidate.codexAccountId,
+                    selectionReason: selectionReasons[0] ?? 'direct',
                     failureReason: null,
                     sanitizedError: null,
                     upstreamRequestId: null,
@@ -264,8 +261,6 @@ export class GatewayRunner {
                     resultToolCalls = out.result.toolCalls;
                     resultFinishReason = out.result.finishReason;
                     recordSuccess(provider.id);
-                    if (candidate.codexAccountId)
-                        setCodexAccountHealth(candidate.codexAccountId, 'healthy');
                     getDb().update(schema.providers).set({ healthState: 'healthy', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     attempts.push(attempt);
                     sentToClient = out.streamStarted ?? false;
@@ -299,12 +294,8 @@ export class GatewayRunner {
                     }
                     attempts.push(attempt);
                     lastError = err;
-                    if (isUpstreamHealthFailure(err)) {
-                        recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
-                        if (candidate.codexAccountId)
-                            setCodexAccountHealth(candidate.codexAccountId, 'down', redactString(err.message));
-                        getDb().update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
-                    }
+                    recordFailure(provider.id, provider.cbFailureThreshold, provider.cbCooldownSeconds);
+                    getDb().update(schema.providers).set({ healthState: 'down', updatedAt: new Date().toISOString() }).where(eq(schema.providers.id, provider.id)).run();
                     if (shouldRetry && i + 1 < maxAttempts) {
                         metrics.fallbackCount.inc();
                         continue;
@@ -319,6 +310,7 @@ export class GatewayRunner {
                 httpStatus: lastError ? lastError.status : 200,
                 errorType: lastError?.type ?? null,
                 errorMessage: lastError ? redactString(lastError.message) : null,
+                errorCode: lastError?.code ?? null,
                 text: lastError ? null : resultText,
                 toolCalls: lastError ? null : resultToolCalls,
                 finishReason: lastError ? null : resultFinishReason,
@@ -367,52 +359,43 @@ export class GatewayRunner {
             metrics.activeRequests.dec();
         }
     }
+    /** Resolve a direct physical model into a candidate, reporting the exact
+     *  reason it cannot serve the request instead of a blanket "no candidates". */
     async loadModelCandidate(modelId, required, requestId) {
         const db = getDb();
-        const reject = (reason) => {
+        const reject = (publicModelId, reason) => {
             if (requestId)
                 debugHttp(requestId, 'CAPABILITY REJECT', [`modelId=${modelId}`, `reason=${reason}`]);
+            return [{ publicModelId, reason }];
         };
         const m = db.select().from(schema.models).where(eq(schema.models.id, modelId)).get();
-        if (!m) {
-            reject('model_not_found');
-            return [];
-        }
+        if (!m)
+            return { candidates: [], rejected: reject(modelId, 'model_not_found') };
         const p = db.select().from(schema.providers).where(eq(schema.providers.id, m.providerId)).get();
-        if (!p) {
-            reject('provider_not_found');
-            return [];
-        }
-        if (!p.enabled) {
-            reject('provider_disabled');
-            return [];
-        }
+        if (!p)
+            return { candidates: [], rejected: reject(m.publicModelId, 'provider_not_found') };
+        if (!p.enabled)
+            return { candidates: [], rejected: reject(m.publicModelId, 'provider_disabled') };
         const caps = safeJson(m.capabilitiesJson);
         const candidate = {
             modelId: m.id,
             publicModelId: m.publicModelId,
             providerId: m.providerId,
             enabled: m.enabled,
+            providerEnabled: p.enabled,
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: caps,
         };
-        if (!m.enabled) {
-            reject('model_disabled');
-            return [];
-        }
-        if (!m.upstreamAvailable) {
-            reject('upstream_unavailable');
-            return [];
-        }
-        if (candidate.circuitOpen) {
-            reject('circuit_open');
-            return [];
-        }
-        if (!modelMeets(caps, required)) {
-            reject('capability_mismatch');
-            return [];
-        }
+        if (!m.enabled)
+            return { candidates: [], rejected: reject(m.publicModelId, 'model_disabled') };
+        if (!m.upstreamAvailable)
+            return { candidates: [], rejected: reject(m.publicModelId, 'upstream_unavailable') };
+        if (candidate.circuitOpen)
+            return { candidates: [], rejected: reject(m.publicModelId, 'circuit_open') };
+        const missing = firstMissingCapability(caps, required);
+        if (missing)
+            return { candidates: [], rejected: reject(m.publicModelId, missing) };
         debugHttp(requestId ?? '-', 'CAPABILITY CANDIDATE', [
             `model=${m.publicModelId}`,
             `caps.tools=${caps.tools}`,
@@ -421,28 +404,26 @@ export class GatewayRunner {
             `caps.image_input=${caps.image_input}`,
             `caps.structured_output=${caps.structured_output}`,
         ]);
-        if (p.type === 'codex') {
-            const expanded = expandCodexAccountCandidates(candidate, listCodexAccountsForProvider(p.id));
-            if (expanded.length === 0)
-                reject('codex_account_unavailable');
-            return expanded;
-        }
-        return [candidate];
+        return { candidates: [candidate], rejected: [] };
     }
     async loadAllModels() {
         const db = getDb();
         const models = db.select().from(schema.models).all();
         const providers = db.select().from(schema.providers).all();
         const providerEnabled = new Map(providers.map((p) => [p.id, p.enabled]));
+        // Deliberately unfiltered: every combo member must reach selectCandidates so
+        // it can report WHY it was skipped. Pre-filtering here erased the model rows
+        // and turned every distinct reason into "model not found".
         return models.map((m) => ({
             modelId: m.id,
             publicModelId: m.publicModelId,
             providerId: m.providerId,
             enabled: m.enabled,
+            providerEnabled: providerEnabled.get(m.providerId),
             upstreamAvailable: m.upstreamAvailable,
             circuitOpen: isOpen(m.providerId),
             capabilities: safeJson(m.capabilitiesJson),
-        })).filter((m) => m.enabled && m.upstreamAvailable && providerEnabled.get(m.providerId));
+        }));
     }
     async runOneAttempt(req, ctx, candidate, providerName, cfg, required, onStreamStart, onFirstToken) {
         if (req.canonical.stream) {
@@ -452,10 +433,6 @@ export class GatewayRunner {
     }
     async runNonStreamingAttempt(req, candidate, cfg, ctx) {
         const upstreamModel = candidate.publicModelId.split('/').slice(1).join('/');
-        if (cfg.type === 'codex') {
-            const out = await callCodexNonStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel });
-            return { statusCode: out.status, ttftMs: null, upstreamRequestId: out.upstreamRequestId, usage: out.usage, result: { text: out.text, toolCalls: out.toolCalls, finishReason: out.finishReason } };
-        }
         let call;
         if (cfg.type === 'openai') {
             const payload = canonicalToOpenAIRequest(req.canonical, upstreamModel);
@@ -468,20 +445,21 @@ export class GatewayRunner {
             call = await callUpstreamNonStreaming(cfg, upstreamUrl(cfg, '/v1/messages'), payload, ctx.requestId);
         }
         if (!call.ok) {
-            if (call.status === 429)
-                throw new GatewayError('upstream_rate_limit', `Upstream rate limited (HTTP ${call.status})`, { status: 429, code: 'upstream_http_429' });
-            if (call.status === 401 || call.status === 403)
-                throw new GatewayError('upstream_auth_error', 'Upstream authentication failed', { status: 502 });
-            if (call.status >= 500)
-                throw new GatewayError('upstream_error', `Upstream HTTP ${call.status}`, { status: 502, code: `upstream_http_${call.status}`, cause: { status: call.status } });
-            throw new GatewayError('upstream_error', `Upstream HTTP ${call.status}: ${redactString(call.text.slice(0, 300))}`, { status: 502, cause: { status: call.status } });
+            throw upstreamHttpError(call.status, redactString(call.text.slice(0, 300)));
         }
         let parsed;
         try {
             parsed = JSON.parse(call.text);
         }
         catch {
-            throw new GatewayError('upstream_error', 'Upstream returned invalid JSON', { status: 502 });
+            throw new GatewayError('upstream_error', `Upstream returned invalid JSON for "${bareModelName(candidate.publicModelId)}"`, { status: 502, code: 'upstream_bad_response' });
+        }
+        // A 200 carrying the wrong shape used to explode into a raw
+        // "Cannot read properties of undefined (reading '0')" that reached the client
+        // verbatim. Name the model and the missing field instead.
+        const expectedField = cfg.type === 'openai' ? 'choices' : 'content';
+        if (!parsed || typeof parsed !== 'object' || !Array.isArray(parsed[expectedField])) {
+            throw new GatewayError('upstream_error', `Upstream response for "${bareModelName(candidate.publicModelId)}" has no "${expectedField}" array`, { status: 502, code: 'upstream_bad_response' });
         }
         let result;
         let usage;
@@ -624,26 +602,6 @@ export class GatewayRunner {
             return;
         };
         try {
-            if (cfg.type === 'codex') {
-                const events = [];
-                let firstCodexEvent = true;
-                const meta = await callCodexStreaming({ baseUrl: cfg.baseUrl, accountId: cfg.codexAccountId ?? '', accountRecordId: cfg.accountRecordId, customHeaders: cfg.customHeaders, totalTimeoutMs: cfg.totalTimeoutMs }, { ...req.canonical, model: upstreamModel }, (event) => {
-                    if (event.text || event.isLast) {
-                        events.push(event);
-                        if (event.usage)
-                            Object.assign(usage, event.usage);
-                        chunkHandler({ data: codexStreamEventToClient(req.protocol, event, upstreamModel, ctx.requestId) }, firstCodexEvent);
-                        firstCodexEvent = false;
-                    }
-                });
-                if (!headWritten)
-                    writeHead();
-                pipe.write('data: [DONE]\n\n');
-                pipe.end();
-                if (!usage.total)
-                    usage.total = usage.input + usage.output;
-                return { statusCode: meta.status, ttftMs: events.length ? Date.now() - streamStartTs : null, upstreamRequestId: meta.upstreamRequestId, usage, result: { text: textBuf, toolCalls: toolBuf, finishReason } };
-            }
             const url = cfg.type === 'openai' ? upstreamUrl(cfg, '/v1/chat/completions') : upstreamUrl(cfg, '/v1/messages');
             const payload = cfg.type === 'openai' ? canonicalToOpenAIRequest(req.canonical, upstreamModel) : canonicalToAnthropicRequest(req.canonical, upstreamModel);
             logUpstreamRequest(ctx.requestId, cfg, url, payload, true);
@@ -813,6 +771,7 @@ export class GatewayRunner {
             httpStatus: 200,
             errorType: null,
             errorMessage: null,
+            errorCode: null,
             text,
             toolCalls,
             finishReason,
@@ -878,7 +837,6 @@ export class GatewayRunner {
                 attemptNumber: a.attemptNumber,
                 providerId: a.providerId,
                 modelId: a.modelId,
-                codexAccountId: a.codexAccountId ?? null,
                 startedAt: a.startedAt,
                 completedAt: a.completedAt,
                 statusCode: a.statusCode,
@@ -901,10 +859,7 @@ export class GatewayRunner {
         emitRequestLogged(requestId);
     }
 }
-export function isUpstreamHealthFailure(err) {
-    return ['connection_error', 'connect_timeout', 'first_token_timeout', 'http_status', 'upstream_rate_limit'].includes(classifyFailure(err));
-}
-export function classifyFailure(err) {
+function classifyFailure(err) {
     switch (err.type) {
         case 'timeout_error':
             return err.message.includes('first token') ? 'first_token_timeout' : 'connect_timeout';
@@ -912,10 +867,8 @@ export function classifyFailure(err) {
             return 'connection_error';
         case 'upstream_rate_limit':
             return 'http_status';
-        case 'upstream_error': {
-            const upstreamStatus = err.cause?.status;
-            return typeof upstreamStatus === 'number' && upstreamStatus >= 500 && upstreamStatus < 600 ? 'http_status' : 'unknown';
-        }
+        case 'upstream_error':
+            return err.status >= 500 ? 'http_status' : 'connection_error';
         default:
             return 'unknown';
     }
@@ -1011,21 +964,6 @@ function safeJsonParse(s) {
 function usageFromCache(u) {
     return u ? { ...u, total: u.input + u.output } : { input: 0, output: 0, cacheRead: 0, cacheWrite: 0, reasoning: 0, total: 0 };
 }
-// Map Codex's native response events to the public protocol stream shape.
-export function codexStreamEventToClient(protocol, event, model, requestId) {
-    if (protocol === 'openai') {
-        return JSON.stringify({
-            id: `chatcmpl-${requestId}`,
-            object: 'chat.completion.chunk',
-            created: Math.floor(Date.now() / 1000),
-            model,
-            choices: [{ index: 0, delta: event.isLast ? {} : { content: event.text }, finish_reason: event.isLast ? 'stop' : null }],
-        });
-    }
-    return JSON.stringify(event.isLast
-        ? { type: 'message_delta', delta: { stop_reason: 'end_turn', stop_sequence: null }, usage: { output_tokens: 0 } }
-        : { type: 'content_block_delta', index: 0, delta: { type: 'text_delta', text: event.text } });
-}
 // SSE encoders: canonical stream chunk -> client protocol event
 function openaiStreamEncoder(data, _event) {
     if (data === '[DONE]')

package/dist/server/protocols/anthropic.js

@@ -53,7 +53,9 @@ function parseAnthropicUserContent(content) {
                 out.push({ type: 'image', image: { base64: b.source.data, mimeType: b.source.media_type } });
             }
             else if (b.source.type === 'url') {
-                out.push({ type: 'image', image: { url: b.source.data } });
+                // Anthropic's url source carries the image in `url`; only our own older
+                // base64->url downgrade ever put it in `data` (see canonicalToAnthropicRequest).
+                out.push({ type: 'image', image: { url: b.source.url ?? b.source.data } });
             }
         }
         if (b.type === 'tool_result') {
@@ -84,8 +86,8 @@ export function canonicalToAnthropicRequest(req, targetModel) {
                         blocks.push({ type: 'text', text: b.text });
                     if (b.type === 'image' && b.image?.base64)
                         blocks.push({ type: 'image', source: { type: 'base64', media_type: b.image.mimeType ?? 'image/png', data: b.image.base64 } });
-                    if (b.type === 'image' && b.image?.url)
-                        blocks.push({ type: 'image', source: { type: 'url', media_type: 'image/png', data: b.image.url } });
+                    else if (b.type === 'image' && b.image?.url)
+                        blocks.push({ type: 'image', source: { type: 'url', url: b.image.url } });
                     if (b.type === 'tool_result')
                         blocks.push({ type: 'tool_result', tool_use_id: b.toolResult.toolUseId, content: b.toolResult.content, is_error: b.toolResult.isError });
                 }

package/dist/server/protocols/canonical.js

@@ -20,10 +20,14 @@ export function openAIToCanonical(req) {
                 blocks.push({ type: 'text', text: m.content });
             else if (Array.isArray(m.content)) {
                 for (const c of m.content) {
-                    if (c.type === 'text' && c.text)
-                        blocks.push({ type: 'text', text: c.text });
-                    else if (c.type === 'image_url' && c.image_url)
-                        blocks.push({ type: 'image', image: { url: c.image_url.url } });
+                    const t = textBlock(c);
+                    if (t)
+                        blocks.push(t);
+                    else {
+                        const u = imageUrlOf(c);
+                        if (u)
+                            blocks.push({ type: 'image', image: { url: u } });
+                    }
                 }
             }
             if (m.tool_calls) {
@@ -192,15 +196,32 @@ function normalizeContent(content) {
     if (Array.isArray(content)) {
         const out = [];
         for (const b of content) {
-            if (b.type === 'text' && b.text)
-                out.push({ type: 'text', text: b.text });
-            if (b.type === 'image_url' && b.image_url)
-                out.push({ type: 'image', image: { url: b.image_url.url } });
+            const t = textBlock(b);
+            if (t)
+                out.push(t);
+            const u = imageUrlOf(b);
+            if (u)
+                out.push({ type: 'image', image: { url: u } });
         }
         return out;
     }
     throw new GatewayError('invalid_request_error', 'Unsupported message content', { status: 400 });
 }
+// OpenAI Responses (`input_text`/`output_text`, `input_image`) and Chat
+// (`text`/`image_url`) use different part names for the same content.
+function textBlock(c) {
+    if (!c.text)
+        return null;
+    return c.type === 'text' || c.type === 'input_text' || c.type === 'output_text' ? { type: 'text', text: c.text } : null;
+}
+// `image_url` is an object in Chat Completions and a plain string in Responses.
+function imageUrlOf(c) {
+    if (c.type !== 'image_url' && c.type !== 'input_image')
+        return undefined;
+    if (typeof c.image_url === 'string')
+        return c.image_url;
+    return typeof c.image_url?.url === 'string' ? c.image_url.url : undefined;
+}
 function safeJson(s) {
     try {
         return JSON.parse(s);

package/dist/server/providers/index.js

@@ -1,5 +1,4 @@
 // Upstream provider adapters: OpenAI-compatible + Anthropic-compatible.
-export { probeCodex, codexModels } from './codex.js';
 function buildHeaders(cfg, extra) {
     const h = {
         'content-type': 'application/json',
@@ -25,8 +24,6 @@ async function fetchWithTimeout(url, init, totalTimeoutMs) {
 }
 export async function probeProvider(cfg) {
     const start = Date.now();
-    if (cfg.type === 'codex')
-        return { ok: false, detail: 'Codex providers require the Codex account adapter', latencyMs: 0 };
     try {
         const url = cfg.type === 'openai' ? `${stripSlash(cfg.baseUrl)}/v1/models` : `${stripSlash(cfg.baseUrl)}/v1/models`;
         const res = await fetchWithTimeout(url, { method: 'GET', headers: buildHeaders(cfg) }, cfg.totalTimeoutMs);
@@ -43,8 +40,6 @@ export async function probeProvider(cfg) {
     }
 }
 export async function discoverProviderModels(cfg) {
-    if (cfg.type === 'codex')
-        throw new Error('Codex providers require the Codex account adapter');
     if (cfg.type === 'openai')
         return discoverOpenAI(cfg);
     return discoverAnthropic(cfg);
@@ -83,12 +78,34 @@ function inferOpenAICapabilities(id) {
         chat: true,
         streaming: true,
         tools: !(lower.includes('embedding') || lower.includes('whisper') || lower.includes('dall-e') || lower.includes('tts')),
-        image_input: lower.includes('vision') || lower.includes('gpt-4o') || lower.includes('4-vision') || lower.includes('claude'),
-        structured_output: lower.includes('gpt-4') || lower.includes('gpt-3.5') || lower.includes('o1') || lower.includes('claude'),
-        reasoning: lower.includes('o1') || lower.includes('o3') || lower.includes('reasoning'),
+        // image_input / structured_output / reasoning are intentionally omitted.
+        // A guessed `false` is read as "known unsupported" and hard-rejects matching
+        // requests (docs/04 §capability filtering); docs/00 requires unknown
+        // capabilities to stay unknown, so leave them undefined (undefined = allow).
+        // ponytail: name-based guessing was wrong for most ids (e.g. qwen-vl-max,
+        // claude-sonnet-4-5). Upgrade path: a real /models metadata probe, or the
+        // admin capability override UI.
     };
 }
 function stripSlash(u) {
     return u.endsWith('/') ? u.slice(0, -1) : u;
 }
+/**
+ * Merge freshly discovered capabilities into a stored model record.
+ *
+ * `baseline` is what discovery last wrote for this model. An admin edit is by
+ * definition a divergence from that baseline, so those keys survive a
+ * re-import; everything else is refreshed (this is what clears stale guesses
+ * such as `image_input: false`). A record with no baseline predates this
+ * tracking, so it is refreshed wholesale rather than preserved blindly.
+ */
+export function mergeDiscoveredCapabilities(stored, baseline, discovered) {
+    const overrides = {};
+    if (baseline) {
+        for (const [k, v] of Object.entries(stored))
+            if (stored[k] !== baseline[k])
+                overrides[k] = v;
+    }
+    return { capabilities: { ...discovered, ...overrides }, baseline: discovered };
+}
 export { buildHeaders, fetchWithTimeout, stripSlash };

package/dist/server/routes/admin/auth.js

@@ -3,8 +3,7 @@ import argon2 from 'argon2';
 import { getDb, schema } from '../../db/index.js';
 import { recordAudit } from '../../db/repositories/audit.js';
 import { uuid, generateSessionToken, sha256Hex } from '../../auth/ids.js';
-import crypto from 'node:crypto';
-import { requireAdminAuth, csrfTokenForSession } from '../../auth/middleware.js';
+import { requireAdminAuth } from '../../auth/middleware.js';
 import { GatewayError } from '../../errors.js';
 const LoginBody = z.object({
     username: z.string().min(1).max(64),
@@ -77,7 +76,6 @@ export async function registerAuthRoutes(app) {
             ip: req.ip,
             userAgent: (req.headers['user-agent'] ?? '').toString().slice(0, 256),
         }).run();
-        db.insert(schema.csrfTokens).values({ id: uuid(), sessionId: id, token: crypto.randomBytes(32).toString('base64url'), expiresAt: sessionExpiry() }).run();
         db.update(schema.adminAccount).set({ lastLoginAt: new Date().toISOString() }).where(sql `id = ${account.id}`).run();
         recordAudit({ action: 'admin.login', success: true, ip: req.ip, targetType: 'admin', targetId: account.id, targetName: account.username });
         reply.setCookie(SessionCookie, token, {
@@ -99,7 +97,6 @@ export async function registerAuthRoutes(app) {
         reply.clearCookie(SessionCookie, { path: '/' });
         return { ok: true };
     });
-    app.get('/api/admin/csrf', { preHandler: requireAdminAuth }, async (req) => ({ csrfToken: csrfTokenForSession(req.adminSessionId) }));
     app.get('/api/admin/me', { preHandler: requireAdminAuth }, async (req) => {
         const account = req.adminAccount;
         return {