Skip to content

fix(responses): gate service tiers by provider capability - #860

Open
F1Justin wants to merge 1 commit into
lidge-jun:devfrom
F1Justin:fix/deepseek-responses-service-tier
Open

fix(responses): gate service tiers by provider capability#860
F1Justin wants to merge 1 commit into
lidge-jun:devfrom
F1Justin:fix/deepseek-responses-service-tier

Conversation

@F1Justin

@F1Justin F1Justin commented Aug 1, 2026

Copy link
Copy Markdown

Summary

  • Add a provider-level supportsServiceTier capability for Responses routes.
  • Mark the canonical OpenAI Responses providers as supporting service tiers and DeepSeek as not supporting them.
  • Let fastMode inject or remove service_tier only for providers that explicitly support it, and strip the field for providers that explicitly reject it.
  • Preserve caller-supplied values for unclassified custom Responses providers.
  • Keep the capability as registry-enriched runtime metadata so older canonical OpenAI configs remain valid.
  • Document the capability and the DeepSeek behavior in every maintained locale.

Why

fastMode previously treated every openai-responses destination like OpenAI and could inject service_tier: "priority". DeepSeek V4 Flash now uses its native Responses endpoint by default, but DeepSeek's published Responses schema does not document service_tier. Provider transport and service-tier capability need to be separate decisions.

This change keeps native DeepSeek Responses routing intact while preventing an OpenAI-only request field from reaching that upstream.

DeepSeek reference: https://api-docs.deepseek.com/api/create-response/

Verification

  • bun test tests/deepseek-inbound-wire.test.ts — 19 pass.
  • Focused canonical OpenAI management checks — 3 pass after keeping the new capability out of persisted canonical seeds.
  • bun run typecheck — pass.
  • bun run privacy:scan — pass.
  • cd docs-site && bun run build — pass (146 pages).
  • Full-suite attempt before the final canonical-seed compatibility adjustment: 6,786 pass, 7 skip, 10 fail. The three patch-caused canonical OpenAI failures were fixed and pass in the focused rerun. The remaining affected-file rerun is 37 pass / 7 fail because this machine's Clash fake-IP DNS resolves test-only hosts such as *.example.test and proxy-only.invalid into 198.18.0.0/15, which the destination-policy tests intentionally reject. CI should provide the clean non-fake-IP run.

Scope

  • No authentication, credential, destination, or provider selection behavior changes.
  • No request bodies, API keys, or account identifiers are logged.
  • Explicit per-provider configuration remains backward compatible.

Summary by CodeRabbit

  • New Features
    • Added provider configuration for declaring Responses API service-tier support.
    • Fast mode now applies service-tier settings only to providers that support them.
    • Caller-supplied service-tier values are preserved for unclassified providers.
    • Unsupported providers no longer receive service-tier fields.
  • Documentation
    • Updated configuration and fast-tier guidance across supported languages, including DeepSeek V4 Flash compatibility details.
  • Bug Fixes
    • Improved handling of stale provider configurations and service-tier overrides.

@coderabbitai

coderabbitai Bot commented Aug 1, 2026

Copy link
Copy Markdown

Review Change Stack

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info
⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 9378ced1-0292-4096-b26d-c3b700053408

📥 Commits

Reviewing files that changed from the base of the PR and between aae9426 and e0487c0.

📒 Files selected for processing (17)
  • docs-site/src/content/docs/guides/codex-app-models.md
  • docs-site/src/content/docs/ja/guides/codex-app-models.md
  • docs-site/src/content/docs/ja/reference/configuration.md
  • docs-site/src/content/docs/ko/guides/codex-app-models.md
  • docs-site/src/content/docs/ko/reference/configuration.md
  • docs-site/src/content/docs/reference/configuration.md
  • docs-site/src/content/docs/ru/guides/codex-app-models.md
  • docs-site/src/content/docs/ru/reference/configuration.md
  • docs-site/src/content/docs/zh-cn/guides/codex-app-models.md
  • docs-site/src/content/docs/zh-cn/reference/configuration.md
  • src/config.ts
  • src/providers/derive.ts
  • src/providers/registry.ts
  • src/router.ts
  • src/server/responses/core.ts
  • src/types.ts
  • tests/deepseek-inbound-wire.test.ts

📝 Walkthrough

Walkthrough

The change adds supportsServiceTier provider metadata, propagates registry values into routed configurations, gates Responses service_tier rewriting, adds coverage for supported and unsupported providers, and updates multilingual documentation.

Changes

Responses service-tier capability

Layer / File(s) Summary
Capability contracts and propagation
src/types.ts:939-945, src/config.ts:485, src/providers/registry.ts:164-165,205,542,714,938-939, src/providers/derive.ts:8,162,264-266, src/router.ts:262-264
Adds optional supportsServiceTier configuration and registry metadata. Registry values propagate to derived and routed providers only when user configuration omits them. OpenAI providers opt in, and DeepSeek opts out.
Responses service-tier handling and validation
src/server/responses/core.ts:802-821, tests/deepseek-inbound-wire.test.ts:151-155,169-173,202-305
Rewrites or removes service_tier only according to provider capability. Tests cover stale DeepSeek and OpenAI configurations and unclassified custom Responses providers.
Configuration and model behavior documentation
docs-site/src/content/docs/reference/configuration.md:318, docs-site/src/content/docs/*/reference/configuration.md, docs-site/src/content/docs/guides/codex-app-models.md:169-172, docs-site/src/content/docs/*/guides/codex-app-models.md
Documents capability values, caller-supplied tier preservation, fast-mode injection, and DeepSeek V4 Flash behavior in five languages.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant Client
  participant router.ts
  participant ProviderRegistry
  participant responses/core.ts
  participant UpstreamResponsesAPI
  Client->>router.ts: Submit Responses request
  router.ts->>ProviderRegistry: Resolve supportsServiceTier
  ProviderRegistry-->>router.ts: Return provider capability
  router.ts->>responses/core.ts: Process request and fastMode
  responses/core.ts->>UpstreamResponsesAPI: Forward, inject, or remove service_tier
Loading

Possibly related PRs

  • lidge-jun/opencodex#611: Both changes extend provider registry metadata and propagate it through derive.ts and router.ts.

Suggested reviewers: ingwannu, lidge-jun

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name Status Explanation Resolution
Docstring Coverage ⚠️ Warning Docstring coverage is 16.67% which is insufficient. The required threshold is 80.00%. Write docstrings for the functions missing them to satisfy the coverage threshold.
✅ Passed checks (4 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes gating Responses service tiers by provider capability, which is the pull request's main change.
Linked Issues check ✅ Passed Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check ✅ Passed Check skipped because no linked issues were found for this pull request.
✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests

Comment @coderabbitai help to get the list of available commands.

@github-actions github-actions Bot added the bug Something isn't working label Aug 1, 2026
@F1Justin
F1Justin marked this pull request as ready for review August 1, 2026 15:57
Copilot AI review requested due to automatic review settings August 1, 2026 15:57

Copilot AI left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Adds a provider capability flag to control whether fastMode may inject/remove OpenAI’s service_tier on Responses requests, preventing OpenAI-only fields from being forwarded to Responses-compatible upstreams (notably DeepSeek) that reject unknown top-level parameters.

Changes:

  • Introduce supportsServiceTier?: boolean across provider config/types/registry and backfill it from registry metadata at runtime.
  • Gate service_tier injection/removal in Responses request normalization on supportsServiceTier (inject/remove only when true; always strip when false).
  • Add focused wire-level regression tests and update configuration/docs in all maintained locales.

Reviewed changes

Copilot reviewed 17 out of 17 changed files in this pull request and generated 1 comment.

Show a summary per file
File Description
tests/deepseek-inbound-wire.test.ts Adds capability-gated service_tier forwarding/injection tests and updates existing assertions.
src/types.ts Extends OcxProviderConfig with supportsServiceTier documentation and typing.
src/server/responses/core.ts Gates service_tier normalization behavior based on supportsServiceTier for openai-responses routes.
src/router.ts Backfills supportsServiceTier from the registry into routed provider configs when unset in persisted config.
src/providers/registry.ts Defines supportsServiceTier in the registry schema and marks OpenAI providers as supported / DeepSeek as unsupported.
src/providers/derive.ts Ensures derived provider metadata can include supportsServiceTier and backfills it during enrichment.
src/config.ts Allows supportsServiceTier in the provider config schema.
docs-site/src/content/docs/reference/configuration.md Documents the new supportsServiceTier provider option (English).
docs-site/src/content/docs/zh-cn/reference/configuration.md Documents the new supportsServiceTier provider option (zh-cn).
docs-site/src/content/docs/ru/reference/configuration.md Documents the new supportsServiceTier provider option (ru).
docs-site/src/content/docs/ko/reference/configuration.md Documents the new supportsServiceTier provider option (ko).
docs-site/src/content/docs/ja/reference/configuration.md Documents the new supportsServiceTier provider option (ja).
docs-site/src/content/docs/guides/codex-app-models.md Updates fast/service-tier behavior explanation (English).
docs-site/src/content/docs/zh-cn/guides/codex-app-models.md Updates fast/service-tier behavior explanation (zh-cn).
docs-site/src/content/docs/ru/guides/codex-app-models.md Updates fast/service-tier behavior explanation (ru).
docs-site/src/content/docs/ko/guides/codex-app-models.md Updates fast/service-tier behavior explanation (ko).
docs-site/src/content/docs/ja/guides/codex-app-models.md Updates fast/service-tier behavior explanation (ja).

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

{ model: "", provider: "" },
{ inboundWire: "responses" },
);
return bodies[0] ?? {};
@lidge-jun

Copy link
Copy Markdown
Owner

Pre-merge review result: not merge-ready yet. Two blocking items:

  1. Unknown capability fails open. src/server/responses/core.ts:805 strips service_tier only when supportsServiceTier === false; undefined passes the caller's value through. The test at tests/deepseek-inbound-wire.test.ts:289 locks in that unsafe default. An unknown-capability provider must strip the OpenAI-only field unless explicitly opted in.
  2. A built-in Responses provider is exposed to that default. src/providers/registry.ts:1186 defines volcengine-agent-plan as openai-responses with no capability classification; a probe against the PR head captured "service_tier":"priority" forwarded upstream. Please classify it (or it inherits the safe default from fix 1).

Also needed before merge:

  1. The strip tests can pass without any upstream request (tests/deepseek-inbound-wire.test.ts:219 returns bodies[0] ?? {}); assert a successful response and exactly one captured body.
  2. Add a wire regression for the canonical native openai Codex-login route (currently only openai-apikey is covered).
  3. Full cross-platform CI never ran on the current head (workflow shows action_required, zero jobs) — it must run green per merge policy. The five doc locales will need to follow whatever default semantics you choose.

The direction is right and the fix is close — re-review should be fast once the default flips to fail-closed.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants