fix(chat): preserve OpenRouter routing in native passthrough

[luvs01]

Summary

• include configured OpenRouter provider routing in native Chat Completions passthrough requests
• apply exact-model preferences before provider-wide defaults, after resolving routed aliases to their native model ids
• write the trusted routing payload after the caller-field whitelist so an inbound provider object cannot override configuration
• preserve the same routing policy when a 429 rotates the active API key
• isolate the key-rotation regression from the user's real OpenCodex configuration
• add focused regressions for defaults, exact overrides, aliases, non-OpenRouter suppression, caller injection, and key rotation

The ordinary OpenAI Chat adapter already serialized openRouterRouting and modelOpenRouterRouting, but the native /v1/chat/completions path did not. As a result, OpenRouter could ignore an operator's only or allow_fallbacks: false policy and route prompts, history, tools, or media to a backend outside the configured set.

This is a cross-provider privacy and routing-policy fix. It does not change destinations, authentication headers, API-key handling, or the Responses path.

The configuration is already documented; this patch makes the native Chat path honor the existing contract, so no documentation change is required.

Verification

Exact current range: 4ef1fcacfaf96e6ee7a9a19b9c483923db4a2474 → 660c8ee74f8a0b70f6a4361fb3a936c7559789b2.

• Bun 1.3.14: tests/openrouter-provider-routing.test.ts — 31 pass, 0 fail, 41 assertions.
• Bun 1.4.0-canary.1: the same focused file — 31 pass, 0 fail, 41 assertions.
• TypeScript typecheck passed on Bun 1.3.14 and Bun 1.4.0-canary.1.
• privacy:scan and git diff --check passed.
• The original two commits replayed patch-identically onto current dev; the follow-up test-only commit gives key rotation a temporary OPENCODEX_HOME and retrying Windows cleanup.
• Independent source and test-isolation reviews found no P0–P2 issue in the final range.
• A full Bun 1.3.14 repository run reached an internal Bun assertion after roughly 253 seconds without a preceding assertion failure.
• An additional Bun 1.4 diagnostic sweep completed all 823 files: 12,532 pass, 40 skip, 89 fail, and 8 harness errors. The observed failures were in files and direct production roots byte-identical to current dev, driven by this host's Windows safe-path/service state, missing subprocess bun/GUI dependency resolution, and existing 5-second timeout cases; no fix(chat): preserve OpenRouter routing in native passthrough #1859 changed-path regression failed. Maintained cross-platform CI remains the authoritative repository-wide baseline.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• New Features

  • OpenAI Chat passthrough requests now apply configured OpenRouter provider routing based on the selected provider and model.
  • Routed requests include the appropriate provider preferences while preserving routing during API-key failover.

• Bug Fixes

  • Prevented caller-supplied provider settings from being applied when requests are sent to non-OpenRouter destinations.

• Tests

  • Added coverage for exact model routing, provider-wide preferences, aliases, destination handling, and key rotation.

[github-actions]

✅ Deterministic PR hygiene checks passed.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: e7f3f423-62c7-4c0c-9f55-420258666502

📥 Commits

Reviewing files that changed from the base of the PR and between 10357d5 and 660c8ee.

📒 Files selected for processing (1)

• tests/openrouter-provider-routing.test.ts

Included review availability: Your plan includes up to 10 reviews per rolling hour; 9 remain after this review.

---

📝 Walkthrough

Walkthrough

OpenAI Chat passthrough requests now resolve OpenRouter routing from the provider and model ID. The adapter adds the resolved provider payload when applicable. Tests cover routing precedence, aliases, non-OpenRouter requests, and API-key rotation.

Changes

OpenRouter passthrough routing

Layer / File(s)	Summary
Apply routing to passthrough requests src/adapters/openai-chat.ts	buildOpenAIChatPassthroughRequest adds the resolved OpenRouter provider-routing payload when routing data is available.
Validate routing behavior tests/openrouter-provider-routing.test.ts	Tests construct native Chat passthrough bodies and cover exact model routing, provider-wide preferences, routed aliases, non-OpenRouter requests, caller-supplied provider data, and routing preservation during API-key rotation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 660c8

This localized change makes native Chat passthrough honor configured OpenRouter routing and preserves that policy during key rotation; focused regressions and static checks pass, and no actionable merge-blocking risk remains beyond normal checks and review.

Possibly related PRs

• lidge-jun/opencodex#406: Adds provider registry discovery and metadata related to provider resolution.
• lidge-jun/opencodex#746: Modifies OpenAI Chat passthrough routing and request construction.
• lidge-jun/opencodex#1512: Modifies OpenAI Chat passthrough request-body construction.

Suggested reviewers: ingwannu

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Docstring Coverage	⚠️ Warning	Docstring coverage is 0.00% which is insufficient. The required threshold is 80.00%.	Write docstrings for the functions missing them to satisfy the coverage threshold.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes preserving OpenRouter routing in native chat passthrough requests, which is the primary change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request is already Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently.
Maintainers: @lidge-jun @Ingwannu @Wibias

[luvs01]

@coderabbitai review

[coderabbitai]

✅ Action performed

Review finished.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[luvs01]

Exact head is now 660c8ee74f8a0b70f6a4361fb3a936c7559789b2, based on current dev@4ef1fcacfaf96e6ee7a9a19b9c483923db4a2474.

Author validation is complete: the focused OpenRouter routing suite passes 31/31 on Bun 1.3.14 and Bun 1.4.0-canary.1; typecheck passes on both runtimes; privacy scan and diff check pass. The key-rotation regression now uses an isolated temporary OpenCodex home. CodeRabbit reviewed the exact head with no actionable comments, all review threads are resolved (0 outstanding), and the readiness checklist is 4/4 with the PR Ready.

Maintainer action requested: approve the fork-gated Cross-platform CI run 32077523324 and React Doctor run 32077523311, then provide the required human review.

[lidge-jun]

Validation before merge: scratch-worktree merge onto current dev — openrouter-provider-routing 31/0 + tsc clean.