fix(combo): surface context-overflow before compression so oversized requests fail fast with a clear error (#10225)

changelog.d/fixes/10225-combo-context-overflow-before-compression.md

@@ -0,0 +1 @@
+- **fix(combo):** defer the known-context-overflow hard rejection for compressible requests so compression runs before the final context gate, instead of a raw-body estimate 400'ing generic Responses clients targeting a large model before OmniRoute can shrink it ([#10225](https://github.com/diegosouzapw/OmniRoute/issues/10225))

changelog.d/fixes/10313-catalog-cache-key-hash.md

@@ -1 +0,0 @@
-- fix(api): hash the API key before using it as the model-catalog cache Map key (no raw credentials in process heap) (#10313)

changelog.d/fixes/9147-catalog-eventloop-yield.md

@@ -1 +0,0 @@
-- fix(api): yield the event loop during catalog builds and bulk-load override/hidden-model tables (#9147)

open-sse/services/combo.ts

@@ -591,6 +591,8 @@ export async function handleComboChat({
   nesting = null,
   hiddenModelsByProvider = getHiddenModelsByProvider(),
   clientManagedResponsesContext = false,
+  deferContextOverflowWhenCompressible = false,
+  compressionExclusions,
 }: HandleComboChatOptions): Promise<Response> {
   const comboCtx = createComboContext({ body, combo, settings, relayOptions, log });
   const {
@@ -651,6 +653,8 @@ export async function handleComboChat({
     signal,
     apiKeyAllowedConnections,
     hiddenModelsByProvider,
+    deferContextOverflowWhenCompressible,
+    compressionExclusions,
     runCombo: handleComboChat,
   });
   if (fusionDispatch) return fusionDispatch;
@@ -700,6 +704,8 @@ export async function handleComboChat({
     signal,
     apiKeyAllowedConnections,
     hiddenModelsByProvider,
+    deferContextOverflowWhenCompressible,
+    compressionExclusions,
     runCombo: handleComboChat,
   });
   if (runtimeUnitDispatch) return runtimeUnitDispatch;
@@ -723,6 +729,8 @@ export async function handleComboChat({
       signal,
       hiddenModelsByProvider,
       clientManagedResponsesContext,
+      deferContextOverflowWhenCompressible,
+      compressionExclusions,
       relayOptions,
     });
   }
@@ -750,6 +758,8 @@ export async function handleComboChat({
     buildAutoCandidates,
     hiddenModelsByProvider,
     clientManagedResponsesContext,
+    deferContextOverflowWhenCompressible,
+    compressionExclusions,
   });
   if ("earlyResponse" in targetResolution) return targetResolution.earlyResponse;
   const { stickyWeightedLimit, getWeightedStepKeyForTarget, preScreenMap } = targetResolution;
@@ -2441,6 +2451,8 @@ async function handleRoundRobinCombo({
   nesting = null,
   hiddenModelsByProvider = getHiddenModelsByProvider(),
   clientManagedResponsesContext,
+  deferContextOverflowWhenCompressible = false,
+  compressionExclusions,
   relayOptions,
 }: HandleRoundRobinOptions): Promise<Response> {
   const config = settings
@@ -2498,6 +2510,8 @@ async function handleRoundRobinCombo({
   const evalRankedTargets = orderTargetsByEvalScores(tagFilteredTargets, config.evalRouting, log);
   const knownContextOverflow = getKnownContextOverflow(evalRankedTargets, body, {
     clientManagedResponsesContext,
+    deferContextOverflowWhenCompressible,
+    compressionExclusions,
   });
   if (knownContextOverflow) {
     return errorResponseWithComboDiagnostics(

open-sse/services/combo/dispatchPrelude.ts

@@ -76,6 +76,10 @@ type PreludeBaseOptionArgs = {
   apiKeyAllowedConnections?: string[] | null;
   hiddenModelsByProvider?: HiddenModelsByProvider;
   clientManagedResponsesContext?: boolean;
+  /** #10225 — defer the hard context-overflow preflight when compression is enabled. */
+  deferContextOverflowWhenCompressible?: boolean;
+  /** Server-side compression exclusions (#8034). */
+  compressionExclusions?: import("../compression/exclusions.ts").CompressionExclusions;
 };
 
 /** Rebuild handleComboChat's option bag verbatim for a recursive dispatch. */
@@ -93,6 +97,8 @@ function buildBaseOptions(a: PreludeBaseOptionArgs): HandleComboChatOptions {
     apiKeyAllowedConnections: a.apiKeyAllowedConnections,
     hiddenModelsByProvider: a.hiddenModelsByProvider,
     clientManagedResponsesContext: a.clientManagedResponsesContext,
+    deferContextOverflowWhenCompressible: a.deferContextOverflowWhenCompressible,
+    compressionExclusions: a.compressionExclusions,
   };
 }
 
@@ -366,6 +372,8 @@ export async function tryFusionDispatch(args: {
   signal?: AbortSignal | null;
   apiKeyAllowedConnections?: string[] | null;
   hiddenModelsByProvider?: HiddenModelsByProvider;
+  deferContextOverflowWhenCompressible?: boolean;
+  compressionExclusions?: import("../compression/exclusions.ts").CompressionExclusions;
   runCombo: RunCombo;
 }): Promise<Response | null> {
   const { cfg, combo, config, strategy, log } = args;
@@ -589,6 +597,8 @@ export async function tryRuntimeUnitDispatch(args: {
   signal?: AbortSignal | null;
   apiKeyAllowedConnections?: string[] | null;
   hiddenModelsByProvider?: HiddenModelsByProvider;
+  deferContextOverflowWhenCompressible?: boolean;
+  compressionExclusions?: import("../compression/exclusions.ts").CompressionExclusions;
   runCombo: RunCombo;
 }): Promise<Response | null> {
   const { body, combo, config, strategy, allCombos, log, settings } = args;

open-sse/services/combo/knownContextOverflow.ts

@@ -17,6 +17,7 @@
  */
 
 import { getResolvedModelCapabilities } from "../modelCapabilities.ts";
+import { isCompressionExcluded, type CompressionExclusions } from "../compression/exclusions.ts";
 import { deriveRequestCompatibilityRequirements } from "./comboStructure.ts";
 import type { ResolvedComboTarget } from "./types.ts";
 
@@ -28,6 +29,19 @@ export type KnownContextOverflow = {
   targetCount: number;
 };
 
+export type KnownContextOverflowOptions = {
+  clientManagedResponsesContext?: boolean;
+  /**
+   * When prompt compression is enabled for this request (global compression switch
+   * AND not API-key opted-out), defer the hard preflight so chatCore's compression
+   * pipeline runs before the final context gate — instead of a raw-body estimate
+   * rejecting a compressible request up front. (#10225)
+   */
+  deferContextOverflowWhenCompressible?: boolean;
+  /** Server-side compression exclusions (#8034) — targets matching one cannot run compression. */
+  compressionExclusions?: CompressionExclusions;
+};
+
 // #7177: an empty array/object (e.g. a default `messages: []` some combo entrypoints inject
 // when the caller sent none) has no real content — counting it would charge a few phantom
 // "structural" tokens (JSON.stringify braces/brackets) toward the estimate, which is enough
@@ -69,7 +83,7 @@ export function getKnownContextLimit(
 export function getKnownContextOverflow(
   targets: ResolvedComboTarget[],
   body: Record<string, unknown>,
-  options: { clientManagedResponsesContext?: boolean } = {}
+  options: KnownContextOverflowOptions = {}
 ): KnownContextOverflow | null {
   if (targets.length === 0) return null;
   // Native Codex Responses clients compact their own item history. Let the concrete
@@ -85,6 +99,31 @@ export function getKnownContextOverflow(
   ) {
     return null;
   }
+  // #10225: a conservative raw-body context estimate must not be treated as proof
+  // that a compression-enabled request cannot fit. When compression is available
+  // for this request AND at least one target can actually run it, defer the hard
+  // rejection so handleChatCore runs proactive compression (chatCore.ts) and its
+  // post-compression enforceOutputTokenBudget becomes the final context gate —
+  // returning a local `context_length_exceeded` only if the compressed body still
+  // cannot fit (no upstream dispatch). Each excluded/native-codex-passthrough
+  // target is skipped; if no target can compress, the fast preflight is kept.
+  if (
+    options.deferContextOverflowWhenCompressible === true &&
+    targets.some(
+      (target) =>
+        !isCompressionExcluded(
+          {
+            provider: target.provider,
+            model: target.modelStr.includes("/")
+              ? target.modelStr.split("/").slice(1).join("/")
+              : target.modelStr,
+          },
+          options.compressionExclusions
+        )
+    )
+  ) {
+    return null;
+  }
   const requirements = deriveRequestCompatibilityRequirements(body);
   if (requirements.requiredContextTokens <= 0) return null;
 

open-sse/services/combo/targetResolution.ts

@@ -115,6 +115,10 @@ export interface ResolveComboTargetPipelineDeps {
   hiddenModelsByProvider?: HiddenModelsByProvider;
   /** Native Responses clients (for example Codex CLI/Desktop) manage compaction themselves. */
   clientManagedResponsesContext?: boolean;
+  /** #10225 — defer the hard context-overflow preflight when compression is enabled for this request. */
+  deferContextOverflowWhenCompressible?: boolean;
+  /** Server-side compression exclusions (#8034) — which targets can run compression. */
+  compressionExclusions?: import("../compression/exclusions.ts").CompressionExclusions;
 }
 
 export interface ResolvedComboTargetPipeline {
@@ -730,6 +734,8 @@ export async function resolveComboTargetPipeline(
 
   const overflow = getKnownContextOverflow(orderedTargets, body, {
     clientManagedResponsesContext: deps.clientManagedResponsesContext,
+    deferContextOverflowWhenCompressible: deps.deferContextOverflowWhenCompressible,
+    compressionExclusions: deps.compressionExclusions,
   });
   if (overflow) {
     return { earlyResponse: buildContextOverflowResponse(overflow, orderedTargets, log) };

open-sse/services/combo/types.ts

@@ -6,6 +6,7 @@
  * — logic unchanged, re-exported from combo.ts for backward compatibility.
  */
 
+import type { CompressionExclusions } from "../compression/exclusions.ts";
 import type { ProviderCandidate } from "../autoCombo/scoring.ts";
 
 export const RESET_WINDOW_NAMES = ["weekly", "session", "monthly"] as const;
@@ -112,6 +113,15 @@ export type HandleComboChatOptions = {
   hiddenModelsByProvider?: HiddenModelsByProvider;
   /** Native Responses clients (for example Codex CLI/Desktop) manage compaction themselves. */
   clientManagedResponsesContext?: boolean;
+  /**
+   * #10225: request-scoped flag — prompt compression is enabled for this request
+   * (global compression switch ON and not opted-out by the API key). When set, the
+   * combo preflight defers its hard context-overflow rejection so chatCore's
+   * compression runs before the final context gate.
+   */
+  deferContextOverflowWhenCompressible?: boolean;
+  /** Server-side compression exclusions (#8034) — used to check which targets can run compression. */
+  compressionExclusions?: CompressionExclusions;
 };
 
 export type HandleRoundRobinOptions = Omit<HandleComboChatOptions, "apiKeyAllowedConnections">;

src/app/api/v1/models/catalog.ts

@@ -6,9 +6,9 @@ import {
   getAllCustomModels,
   getSettings,
   getCachedProviderNodes,
+  getModelIsHidden,
   getModelAliases,
   getDatabaseSettings,
-  getHiddenModelsByProvider,
 } from "@/lib/localDb";
 import { createLazyConnectionView } from "@/lib/db/providers/lazyConnectionView";
 import { extractAliasBackedModels } from "./aliasBackedModels";
@@ -132,7 +132,7 @@ export {
 } from "./catalogCache";
 export type { CachedCatalog } from "./catalogCache";
 
-const BUILTIN_AUTO_YIELD_INTERVAL = 2;
+const BUILTIN_AUTO_YIELD_INTERVAL = 8;
 
 function yieldCatalogBuildTurn(): Promise<void> {
   return new Promise((resolve) => setImmediate(resolve));
@@ -156,8 +156,6 @@ export async function getUnifiedModelsResponse(
     try {
       settingsForAuth = await getSettings();
     } catch {}
-    // #9147: yield before auth check to allow event loop tick
-    await yieldCatalogBuildTurn();
     const authRejection = await getModelCatalogAuthRejection(request, settingsForAuth, {
       ...corsHeaders,
       ...diagnosticHeaders,
@@ -228,28 +226,6 @@ async function buildUnifiedModelsResponseCore(
   corsHeaders: Record<string, string> = {}
 ) {
   const diagnosticHeaders = getCatalogDiagnosticsHeaders({ request });
-  // #9147: this builder walks connections + model registries at catalog scale with no
-  // event-loop yield, so a large deployment pins the single Node.js thread for the
-  // whole build (reporter: 183 connections / 2000+ models → 10.1s stall that blocks the
-  // dashboard WS heartbeat). Yield every `catYIELD_EVERY` items across the hot loops.
-  const catYIELD_EVERY = 20;
-  let catYieldCount = 0;
-  const maybeYieldCatalogBuild = async (): Promise<void> => {
-    catYieldCount++;
-    if (catYieldCount % catYIELD_EVERY === 0) {
-      await yieldCatalogBuildTurn();
-    }
-  };
-  // #9147: `getModelIsHidden()` is a SQLite read per call (custom row + compat list)
-  // and the build consults it ~16× per entry. Bulk-load the hidden-model map once
-  // (one query — `getHiddenModelsByProvider`) and resolve from memory for the whole
-  // build. A provider absent from the map has no hidden models at all — `false`,
-  // no on-demand fallback (that would reintroduce the per-call SQLite reads).
-  const hiddenModelsByProvider = getHiddenModelsByProvider();
-  const isModelHiddenBulk = (providerId: string, modelId: string): boolean => {
-    const hiddenSet = hiddenModelsByProvider.get(providerId);
-    return hiddenSet ? hiddenSet.has(modelId) : false;
-  };
   try {
     let settings: Record<string, any> = {};
     try {
@@ -261,10 +237,6 @@ async function buildUnifiedModelsResponseCore(
       ...diagnosticHeaders,
     });
     if (authRejection) return authRejection;
-
-    // #9147: yield after auth check before DB initialization prologue
-    await yieldCatalogBuildTurn();
-
     const { aliasToProviderId, providerIdToAlias } = buildAliasMaps();
     const _qp = new URL(request.url).searchParams.get("prefix");
     const prefixMode =
@@ -349,7 +321,6 @@ async function buildUnifiedModelsResponseCore(
 
     // Get combos
     let combos = [];
-    await yieldCatalogBuildTurn();
     try {
       combos = await getCombos();
     } catch (e) {
@@ -617,7 +588,7 @@ async function buildUnifiedModelsResponseCore(
           timestamp,
           (c) => buildComboCatalogMetadata(c, combos)
         );
-        const quotaFinal = await applyCatalogPostFilters(request, quotaModels, {
+        const quotaFinal = applyCatalogPostFilters(request, quotaModels, {
           connections,
           prefixMode,
           aliasToProviderId,
@@ -712,7 +683,7 @@ async function buildUnifiedModelsResponseCore(
       ) as ComboCatalogTarget[];
       const visibleTargets = comboTargets.filter((target) => {
         const resolved = getComboTargetModelId(target);
-        return resolved ? !isModelHiddenBulk(resolved.providerId, resolved.modelId) : true;
+        return resolved ? !getModelIsHidden(resolved.providerId, resolved.modelId) : true;
       });
       if (visibleTargets.length === 0) continue;
 
@@ -729,16 +700,11 @@ async function buildUnifiedModelsResponseCore(
         parent: null,
         ...comboMetadata,
       });
-
-      // #9147: combos can number hundreds at catalog scale — yield periodically.
-      await maybeYieldCatalogBuild();
     }
 
     let syncedModelsByProvider: Record<string, SyncedAvailableModel[]> = {};
     try {
-      await yieldCatalogBuildTurn();
       syncedModelsByProvider = await getAllActiveSyncedModels();
-      await yieldCatalogBuildTurn();
     } catch (e) {
       // DB unavailable — log and fall through; static models remain as defaults.
       console.log("[catalog] Could not fetch synced available models:", e);
@@ -826,7 +792,7 @@ async function buildUnifiedModelsResponseCore(
         if (!isModelSelectable(canonicalProviderId, model.id)) continue;
         if (!providerSupportsModel(canonicalProviderId, model.id)) continue;
         const aliasId = `${alias}/${model.id}`;
-        if (isModelHiddenBulk(canonicalProviderId, model.id)) continue;
+        if (getModelIsHidden(canonicalProviderId, model.id)) continue;
         if (shouldHidePaid(canonicalProviderId, model.id, (model as { pricing?: unknown }).pricing))
           continue;
 
@@ -880,15 +846,12 @@ async function buildUnifiedModelsResponseCore(
             ...thinkingCapabilities,
           });
         }
-
-        // #9147: static model walk is the densest loop — yield periodically.
-        await maybeYieldCatalogBuild();
       }
     }
 
     for (const modelId of CODEX_NATIVE_UNPREFIXED_MODELS) {
       if (!providerSupportsModel("codex", modelId)) continue;
-      if (isModelHiddenBulk("codex", modelId)) continue;
+      if (getModelIsHidden("codex", modelId)) continue;
 
       const alias = providerIdToAlias.codex || "cx";
       const aliasId = `${alias}/${modelId}`;
@@ -949,7 +912,7 @@ async function buildUnifiedModelsResponseCore(
           if (canonicalProviderId === "codex" && isCodexDiscoveryModelExcluded(sm)) {
             continue;
           }
-          if (isModelHiddenBulk(providerId, sm.id)) continue;
+          if (getModelIsHidden(providerId, sm.id)) continue;
           // #6457: some upstream discovery catalogs (e.g. HuggingFace's live
           // `/v1/models`) return image/diffusion models with no modality info,
           // so `endpoints` below would default to ["chat"] and misrepresent
@@ -1061,9 +1024,6 @@ async function buildUnifiedModelsResponseCore(
               });
             }
           }
-
-          // #9147: synced-model union is usually the largest walk — yield periodically.
-          await maybeYieldCatalogBuild();
         }
       }
     } catch (err) {
@@ -1093,7 +1053,7 @@ async function buildUnifiedModelsResponseCore(
           if (hidePaid && !isFree) continue;
           // #9293: respect per-model hidden flags (e.g. operator hid google/chirp-3
           // from the OpenRouter provider, so it should not appear in the live catalog).
-          if (isModelHiddenBulk("openrouter", openRouterModel.id)) continue;
+          if (getModelIsHidden("openrouter", openRouterModel.id)) continue;
           const supportedParameters = Array.isArray(openRouterModel.supported_parameters)
             ? openRouterModel.supported_parameters
             : [];
@@ -1134,9 +1094,6 @@ async function buildUnifiedModelsResponseCore(
             ...(outputModalities.length > 0 ? { output_modalities: outputModalities } : {}),
             ...(Object.keys(capabilities).length > 0 ? { capabilities } : {}),
           });
-
-          // #9147: OpenRouter catalog can be large — yield periodically.
-          await maybeYieldCatalogBuild();
         }
       } catch (err) {
         console.error("[catalog] Error loading OpenRouter catalog:", err);
@@ -1181,7 +1138,7 @@ async function buildUnifiedModelsResponseCore(
 
     // Helper: strip the provider prefix from a specialty model ID to get the
     // provider-relative path (e.g. "openrouter/google/chirp-3" -> "google/chirp-3").
-    // This is the correct key used by the hidden-model lookup — using .split("/").pop()
+    // This is the correct key used by getModelIsHidden() — using .split("/").pop()
     // here would discard all but the last segment and miss stored flags for
     // providers whose model IDs carry a sub-path (e.g. OpenRouter scoped models).
     const getSpecialtyModelRelativeId = (modelId: string, provider: string): string =>
@@ -1192,7 +1149,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(embModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(embModel.id, embModel.provider);
       if (!providerSupportsModel(embModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(embModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(embModel.provider, rawModelId)) continue;
       if (hasEquivalentSpecialtyModel(embModel.provider, rawModelId, "embedding", embModel.id)) {
         continue;
       }
@@ -1212,7 +1169,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(imgModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(imgModel.id, imgModel.provider);
       if (!providerSupportsModel(imgModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(imgModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(imgModel.provider, rawModelId)) continue;
       models.push({
         id: imgModel.id,
         object: "model",
@@ -1232,7 +1189,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(rerankModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(rerankModel.id, rerankModel.provider);
       if (!providerSupportsModel(rerankModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(rerankModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(rerankModel.provider, rawModelId)) continue;
       if (hasEquivalentSpecialtyModel(rerankModel.provider, rawModelId, "rerank", rerankModel.id)) {
         continue;
       }
@@ -1251,7 +1208,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(audioModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(audioModel.id, audioModel.provider);
       if (!providerSupportsModel(audioModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(audioModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(audioModel.provider, rawModelId)) continue;
       models.push({
         id: audioModel.id,
         object: "model",
@@ -1267,7 +1224,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(modModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(modModel.id, modModel.provider);
       if (!providerSupportsModel(modModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(modModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(modModel.provider, rawModelId)) continue;
       models.push({
         id: modModel.id,
         object: "model",
@@ -1282,7 +1239,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(videoModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(videoModel.id, videoModel.provider);
       if (!providerSupportsModel(videoModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(videoModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(videoModel.provider, rawModelId)) continue;
       models.push({
         id: videoModel.id,
         object: "model",
@@ -1303,7 +1260,7 @@ async function buildUnifiedModelsResponseCore(
       if (!isProviderActive(musicModel.provider)) continue;
       const rawModelId = getSpecialtyModelRelativeId(musicModel.id, musicModel.provider);
       if (!providerSupportsModel(musicModel.provider, rawModelId)) continue;
-      if (isModelHiddenBulk(musicModel.provider, rawModelId)) continue;
+      if (getModelIsHidden(musicModel.provider, rawModelId)) continue;
       models.push({
         id: musicModel.id,
         object: "model",
@@ -1349,7 +1306,7 @@ async function buildUnifiedModelsResponseCore(
           if (!isUnifiedChatSourceModelSelectable(canonicalProviderId, { ...model, id: modelId }))
             continue;
           if (model.isHidden === true) continue;
-          if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
+          if (getModelIsHidden(canonicalProviderId, modelId)) continue;
           // #6328: apply hidePaidModels to user-defined custom rows too.
           // Custom entries do not carry pricing, so shouldHidePaid() decides
           // via FREE_MODEL_IDS_BY_PROVIDER — matches synced/PROVIDER_MODELS.
@@ -1484,9 +1441,6 @@ async function buildUnifiedModelsResponseCore(
               ...(providerVisionFields || {}),
             });
           }
-
-          // #9147: custom-model walk — yield periodically.
-          await maybeYieldCatalogBuild();
         }
       }
     } catch (e) {
@@ -1532,7 +1486,7 @@ async function buildUnifiedModelsResponseCore(
           continue;
         }
 
-        if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
+        if (getModelIsHidden(canonicalProviderId, modelId)) continue;
         // #6328: apply hidePaidModels to alias-backed rows too. Alias mappings
         // point at providerKey/modelId with no pricing, so shouldHidePaid()
         // decides via the FREE_MODEL_IDS_BY_PROVIDER catalog tier.
@@ -1605,7 +1559,7 @@ async function buildUnifiedModelsResponseCore(
       for (const model of fallbackModels) {
         const modelId = typeof model.id === "string" ? model.id : null;
         if (!modelId) continue;
-        if (isModelHiddenBulk(canonicalProviderId, modelId)) continue;
+        if (getModelIsHidden(canonicalProviderId, modelId)) continue;
         // #6328: apply hidePaidModels to managed-fallback rows too. Compatible
         // provider fallbacks lack pricing; shouldHidePaid() decides via the
         // FREE_MODEL_IDS_BY_PROVIDER catalog tier.
@@ -1632,9 +1586,6 @@ async function buildUnifiedModelsResponseCore(
           ...(contextLength ? { context_length: contextLength } : {}),
           ...(visionFields || {}),
         });
-
-        // #9147: per-connection fallback walk — yield periodically.
-        await maybeYieldCatalogBuild();
       }
     }
 
@@ -1680,7 +1631,7 @@ async function buildUnifiedModelsResponseCore(
       }
     }
     // ?configuredOnly — hide models that have no eligible DB connection.
-    finalModels = await applyCatalogPostFilters(request, finalModels, {
+    finalModels = applyCatalogPostFilters(request, finalModels, {
       connections,
       prefixMode,
       aliasToProviderId,

src/app/api/v1/models/catalogCache.ts

@@ -12,8 +12,6 @@
  * Auth rejection is NOT handled here and must stay in the caller: it depends on
  * live per-request state (dashboard cookie, API key) and must never be cached.
  */
-import { createHash } from "node:crypto";
-
 import { getModelCatalogCacheVersion } from "@/lib/db/readCache";
 import { extractApiKey } from "@/sse/services/auth";
 
@@ -94,18 +92,11 @@ function buildCatalogCacheKey(
   const url = new URL(request.url);
   const prefix = url.searchParams.get("prefix") || "";
   const apiKey = extractApiKey(request) || "";
-  // #10313: NEVER embed the raw bearer secret into the Map key — it lives in process
-  // heap for the cache TTL and would leak the full credential in a heap dump /
-  // --inspect session / debug log. Hash it instead (the established repo idiom:
-  // `hashKey` in apiKeys.ts — intentionally SHA-256, NOT password hashing; API keys
-  // are high-entropy random tokens needing fast O(1) comparison).
-  // lgtm[js/insufficient-password-hash]
-  const apiKeyFingerprint = apiKey ? createHash("sha256").update(apiKey).digest("hex") : ""; // nosemgrep: insufficient-password-hash
   const isCodex = isCodexModelCatalogClient(request) ? "1" : "0";
   const configuredOnly = url.searchParams.get("configuredOnly") === "true" ? "1" : "0";
   const hideAuto = catalogSettings?.hideAutoCombos ? "1" : "0";
   const hideNoThink = catalogSettings?.hideNoThinkVariants ? "1" : "0";
-  return `${prefix}|${isCodex}|${apiKeyFingerprint}|${configuredOnly}|${hideAuto}|${hideNoThink}`;
+  return `${prefix}|${isCodex}|${apiKey}|${configuredOnly}|${hideAuto}|${hideNoThink}`;
 }
 
 // Tracks the model-catalog cache version (src/lib/db/readCache.ts) as of the last

src/app/api/v1/models/catalogResponse.ts

@@ -32,7 +32,6 @@ import {
   enrichCatalogModelEntry,
   type CatalogEnrichmentSnapshot,
 } from "@/lib/modelMetadataRegistry";
-import { createModelCapabilityResolutionSnapshot } from "@/lib/modelCapabilityResolutionSnapshot";
 import { isModelCatalogNamesEnabled } from "@/shared/utils/featureFlags";
 import { extractApiKey } from "@/sse/services/auth";
 import { maybeOmitCatalogModelName } from "./catalogHelpers";
@@ -46,7 +45,7 @@ import { isCodexModelCatalogClient } from "./catalogRequest";
  * returns early, but it still owes the caller these steps — the discovery mirrors in
  * particular are what let Claude Code see a quota pool's models at all.
  */
-export async function applyCatalogPostFilters(
+export function applyCatalogPostFilters(
   request: Request,
   models: Array<Record<string, any>>,
   ctx: {
@@ -55,8 +54,7 @@ export async function applyCatalogPostFilters(
     aliasToProviderId: Record<string, string>;
     hideNoThinkVariants?: boolean;
   }
-): Promise<Array<Record<string, any>>> {
-  const yieldTurn = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
+): Array<Record<string, any>> {
   let finalModels = models;
 
   // variants are only generated for surviving models.
@@ -67,11 +65,6 @@ export async function applyCatalogPostFilters(
     });
   }
 
-  // #9147: the variant-append passes each walk the full model list (O(n) per pass),
-  // so a catalog-scale build must not run all of them in one synchronous stretch.
-  // Yield once between the expensive passes to let the event loop breathe.
-  await yieldTurn();
-
   // Advertise Claude reasoning-effort variants (claude/<model>-{low,medium,high[,xhigh]}).
   // Derived from the already key-filtered list so a variant only appears when its real
   // model is permitted. Runs before the no-thinking pass: the gateway already routes these
@@ -146,15 +139,11 @@ export async function applyCatalogPostFilters(
     );
   }
 
-  await yieldTurn();
-
   // #7694: advertise `<provider>/<model>-<tier>` variants for synced models that
   // captured `reasoning.supported_efforts` at sync time (capabilities.effort_tiers).
   // Derived from the already key-filtered list; skips codex/kimi (own suffix mechanism).
   finalModels = appendSyncedEffortVariants(finalModels);
 
-  await yieldTurn();
-
   // #4424 follow-up — drop exact-duplicate ids that slip through the per-source push
   // guards (e.g. `codex/gpt-5.5`, `veo-free/seedance` listed twice). Keyed by listing
   // identity (id, type, subtype) so the intentional same-id audio transcription/speech
@@ -218,45 +207,25 @@ export async function finalizeCatalogResponse(
   }
 
   const includeModelNames = isModelCatalogNamesEnabled();
-  // #9147: enrichment is the most expensive single stage of the catalog build —
-  // per-entry provider/model resolution plus pricing + token/context override
-  // lookups. Two fixes so a large catalog cannot pin the Node.js thread here:
-  //  (1) bulk-load the synced-capability + override tables ONCE into an in-memory
-  //      snapshot (#9199 machinery) so per-entry enrichment never hits SQLite;
-  //  (2) yield to the event loop every `YIELD_EVERY` entries so even the remaining
-  //      per-entry work is interleaved with other callers / the dashboard WS.
-  const yieldTurn = (): Promise<void> => new Promise((resolve) => setImmediate(resolve));
-  await yieldTurn();
-  const capabilityResolutionSnapshot = createModelCapabilityResolutionSnapshot();
-  const enriched: Array<Record<string, unknown>> = [];
-  const catYIELD_EVERY = 5;
-  let catEnrichCount = 0;
-  for (const model of finalModels) {
-    let listedModel: Record<string, unknown>;
-    if (model.owned_by === "combo") {
-      listedModel = maybeOmitCatalogModelName(model, includeModelNames);
-    } else {
-      const entry = enrichCatalogModelEntry(model, undefined, {
-        ...enrichmentSnapshot,
-        capabilityResolutionSnapshot,
-      });
-      const fallbackContextLength = getContextFallback(entry);
-      listedModel = fallbackContextLength
-        ? { ...entry, context_length: fallbackContextLength }
-        : entry;
-      listedModel = maybeOmitCatalogModelName(listedModel, includeModelNames);
-    }
-    enriched.push(listedModel);
-    catEnrichCount++;
-    if (catEnrichCount % catYIELD_EVERY === 0) {
-      await yieldTurn();
-    }
-  }
-  await yieldTurn();
-  const enrichedModels = disambiguateCatalogModelNames(enriched);
-  await yieldTurn();
+  const enrichedModels = disambiguateCatalogModelNames(
+    finalModels.map((model) => {
+      if (model.owned_by === "combo") {
+        return maybeOmitCatalogModelName(model, includeModelNames);
+      }
+      const enriched = enrichCatalogModelEntry(model, undefined, enrichmentSnapshot);
+      const fallbackContextLength = getContextFallback(enriched);
+      const listedModel = fallbackContextLength
+        ? { ...enriched, context_length: fallbackContextLength }
+        : enriched;
+      return maybeOmitCatalogModelName(listedModel, includeModelNames);
+    })
+  );
+  // Canonical provider-grouped publication: one contiguous block per provider,
+  // combos pinned first. Stable — preserves combo sort_order, connection priority,
+  // and equal-id audio twins. Grouped by owned_by (canonical identity), not the
+  // routing alias prefix. Applied after enrichment/disambiguation so the final
+  // serialized order is what every consumer sees; cached as part of the body.
   const orderedModels = sortCatalogModelsProviderGrouped(enrichedModels);
-  await yieldTurn();
   // Codex CLI compatibility: its model-catalog refresh (codex_models_manager) does
   // GET /v1/models?client_version=<v> and decodes a JSON object with a TOP-LEVEL
   // `models` array, so the OpenAI-standard `{object,data}` shape makes it fail with

src/lib/modelCapabilities.ts

@@ -616,12 +616,9 @@ function getContextOverride(
 /**
  * Resolve a persisted context override by canonical id, then by the exact raw
  * alias supplied by the caller. Neither lookup inherits to related models.
- *
- * `snapshot` is the #9147 build-local bulk load; when supplied the on-demand
- * SQLite read is skipped and the preloaded nested map is used instead.
  */
-export function getResolvedModelContextOverride(input: CapabilityInput, snapshot?: ModelCapabilityResolutionSnapshot | null): number | null {
-  return getContextOverride(resolveCapabilityInput(input), snapshot);
+export function getResolvedModelContextOverride(input: CapabilityInput): number | null {
+  return getContextOverride(resolveCapabilityInput(input));
 }
 
 function getInputTokenCapabilityOverride(resolved: {

src/lib/modelMetadataRegistry.ts

@@ -28,7 +28,6 @@ import {
   CANONICAL_EFFORT_VALUES,
   extendCodexGpt56EffortValues,
 } from "@/shared/reasoning/effortStandardization";
-import type { ModelCapabilityResolutionSnapshot } from "@/lib/modelCapabilityResolutionSnapshot";
 
 const MODEL_METADATA_SCHEMA_VERSION = "model-metadata-v1";
 
@@ -41,9 +40,6 @@ type JsonRecord = Record<string, unknown>;
 export interface CatalogEnrichmentSnapshot {
   modelsDevPricing: PricingByProvider | null;
   providerNodeIdsByPrefix?: Readonly<Record<string, string>>;
-  /** #9147: build-local bulk load of synced capabilities + token/context overrides
-   * so per-entry enrichment never hits SQLite again (see catalogResponse.ts). */
-  capabilityResolutionSnapshot?: ModelCapabilityResolutionSnapshot | null;
 }
 
 interface CatalogDiagnosticsOptions {
@@ -204,27 +200,20 @@ export function getCatalogDiagnosticsHeaders(
 export function getCanonicalModelMetadata(input: {
   provider?: string | null;
   model?: string | null;
-  snapshot?: ModelCapabilityResolutionSnapshot | null;
 }): CanonicalModelMetadata | null {
   const modelId = asNonEmptyString(input.model);
   if (!modelId) return null;
 
-  const resolved = getResolvedModelCapabilities(
-    {
-      provider: input.provider || null,
-      model: modelId,
-    },
-    undefined,
-    input.snapshot || null
-  );
+  const resolved = getResolvedModelCapabilities({
+    provider: input.provider || null,
+    model: modelId,
+  });
   const provider = resolved.provider;
   const providerAlias = provider ? PROVIDER_ID_TO_ALIAS[provider] || provider : null;
   const registryModel = getRegistryModel(providerAlias || provider, resolved.model || modelId);
   const staticSpec = getModelSpec(resolved.model || modelId);
   const syncedCapability =
-    provider && resolved.model
-      ? getSyncedCapability(provider, resolved.model, input.snapshot?.synced ?? null)
-      : null;
+    provider && resolved.model ? getSyncedCapability(provider, resolved.model) : null;
   const canonicalStaticAlias = resolveStaticModelAlias(resolved.model || modelId);
   const modalities = buildModalities(
     resolved.modalitiesInput,
@@ -431,11 +420,7 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
       return id;
     })();
 
-  const metadata = getCanonicalModelMetadata({
-    provider,
-    model,
-    snapshot: snapshot?.capabilityResolutionSnapshot ?? null,
-  });
+  const metadata = getCanonicalModelMetadata({ provider, model });
   if (!metadata) return entry;
   const registryModel = getRegistryModel(
     metadata.providerAlias || metadata.provider,
@@ -451,11 +436,7 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
     getAuthoritativeContextWindow(metadata.model) ??
     getAuthoritativeContextWindow(model);
   const specialtySurface = isNonChatCatalogSurface(entry.type);
-  const capabilitySnapshot = snapshot?.capabilityResolutionSnapshot ?? null;
-  const persistedContextWindow = getResolvedModelContextOverride(
-    { provider, model },
-    capabilitySnapshot
-  );
+  const persistedContextWindow = getResolvedModelContextOverride({ provider, model });
   const capabilityFields = {
     ...(typeof metadata.capabilities.vision === "boolean"
       ? { vision: metadata.capabilities.vision }
@@ -547,15 +528,10 @@ export function enrichCatalogModelEntry<T extends JsonRecord>(
   }
 
   const persistedOutputLimit =
-    getModelCapabilityOverride(provider, model, "max_output_tokens", capabilitySnapshot?.maxTokenOverrides) ??
-    getModelCapabilityOverride(provider, model, "max_token", capabilitySnapshot?.maxTokenOverrides) ??
-    getModelCapabilityOverride(
-      publicProvider,
-      model,
-      "max_output_tokens",
-      capabilitySnapshot?.maxTokenOverrides
-    ) ??
-    getModelCapabilityOverride(publicProvider, model, "max_token", capabilitySnapshot?.maxTokenOverrides);
+    getModelCapabilityOverride(provider, model, "max_output_tokens") ??
+    getModelCapabilityOverride(provider, model, "max_token") ??
+    getModelCapabilityOverride(publicProvider, model, "max_output_tokens") ??
+    getModelCapabilityOverride(publicProvider, model, "max_token");
   if (persistedOutputLimit !== null) {
     nextEntry.max_output_tokens = persistedOutputLimit;
   } else if (

src/sse/handlers/chat.ts

@@ -33,6 +33,8 @@ import type { SingleModelTarget } from "@omniroute/open-sse/services/combo/types
 import { mergeAbortSignals } from "@omniroute/open-sse/executors/base.ts";
 import { resolveRequestAutoControls } from "@omniroute/open-sse/services/autoCombo/requestControls.ts";
 import { isVerifiedNativeCodexRequest } from "@omniroute/open-sse/config/codexIdentity.ts";
+import { resolveCompressionSettings } from "@omniroute/open-sse/handlers/chatCore/compressionSettings.ts";
+import type { CompressionExclusions } from "@omniroute/open-sse/services/compression/exclusions.ts";
 import { resolveComboConfig } from "@omniroute/open-sse/services/comboConfig.ts";
 import { injectHandoffIntoBody } from "@omniroute/open-sse/services/contextHandoff.ts";
 import {
@@ -209,6 +211,31 @@ let combosCacheTs = 0;
 let combosCacheVersionSnapshot = -1;
 const COMBOS_CACHE_TTL_MS = 10_000;
 
+/**
+ * #10225 — resolve whether this request's combo preflight should DEFER its hard
+ * context-overflow rejection so chatCore's compression runs first.
+ *
+ * Mirrors handleChatCore's own enablement determination (chatCore.ts): defer only
+ * when the global compression switch is ON and the API key has not opted out
+ * (`apiKeyInfo.compressionEnabled !== false`). Per-target applicability (server-side
+ * exclusions) is checked inside getKnownContextOverflow via the returned exclusions.
+ * Fail closed (defer=false) on any lookup error — the existing hard preflight stays.
+ */
+async function resolveComboContextOverflowDeferral(
+  logger: { warn?: (...args: unknown[]) => void } | null | undefined,
+  apiKeyInfo: { compressionEnabled?: boolean } | null | undefined
+): Promise<{ defer: boolean; exclusions: CompressionExclusions | undefined }> {
+  try {
+    const compression = await resolveCompressionSettings(logger);
+    return {
+      defer: compression.enabled && apiKeyInfo?.compressionEnabled !== false,
+      exclusions: compression.settings?.exclusions,
+    };
+  } catch {
+    return { defer: false, exclusions: undefined };
+  }
+}
+
 async function getCombosCachedForChat(): Promise<unknown[]> {
   const now = Date.now();
   // Explicit non-null check: we intentionally cache and return the Promise
@@ -824,9 +851,13 @@ async function handleChatImplementation(
 
     // Context-relay keeps generation in combo.ts, but handoff injection lives here
     // because only this layer knows which connectionId was actually selected.
+    const { defer: deferContextOverflowWhenCompressible, exclusions: compressionExclusions } =
+      await resolveComboContextOverflowDeferral(log, apiKeyInfo);
     const response = await (handleComboChat as any)({
       body,
       combo,
+      deferContextOverflowWhenCompressible,
+      compressionExclusions,
       clientManagedResponsesContext:
         sourceFormat === "openai-responses" &&
         new URL(request.url).pathname.split("/").includes("responses") &&
@@ -1103,9 +1134,13 @@ async function handleSingleModelChat(
     );
     log.info("ROUTING", `Auto-combo redirect from handleSingleModelChat for "${modelStr}"`);
     log.info("ROUTING", `Auto-combo redirect to combo flow for "${modelStr}"`);
+    const { defer: sNetDefer, exclusions: sNetExclusions } =
+      await resolveComboContextOverflowDeferral(log, apiKeyInfo);
     return handleComboChat({
       body,
       combo: redirectCombo,
+      deferContextOverflowWhenCompressible: sNetDefer,
+      compressionExclusions: sNetExclusions,
       clientManagedResponsesContext:
         detectFormatFromEndpoint(body, clientRawRequest?.endpoint || "") === "openai-responses" &&
         String(clientRawRequest?.endpoint || "")

tests/unit/10313-catalog-cache-key-hashing.test.ts

@@ -1,128 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-catalog-keyleak-"));
-process.env.DATA_DIR = TEST_DATA_DIR;
-process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-keyleak-test-secret";
-
-const core = await import("../../src/lib/db/core.ts");
-const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
-const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
-const catalogCacheMod = await import("../../src/app/api/v1/models/catalogCache.ts");
-
-const SECRET = "sk-live-PROBE-10313-SUPER-SECRET-TOKEN";
-
-test.beforeEach(() => {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
-  v1ModelsCatalog.__resetCatalogBuilderRunsForTest();
-});
-
-test.after(() => {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-});
-
-function captureMapKeys(): { keys: string[]; restore: () => void } {
-  const capturedKeys: string[] = [];
-  const originalSet = Map.prototype.set;
-  // eslint-disable-next-line @typescript-eslint/no-explicit-any
-  (Map.prototype as any).set = function (key: unknown, value: unknown) {
-    if (typeof key === "string") capturedKeys.push(key);
-    return originalSet.call(this, key, value);
-  };
-  return {
-    keys: capturedKeys,
-    release: () => {
-      Map.prototype.set = originalSet;
-    },
-  };
-}
-
-// buildCatalogCacheKey emits `prefix|isCodex|apiKeyFingerprint|configuredOnly|hideAuto|hideNoThink`
-// (6 pipe-delimited fields). Other in-flight keys (e.g. `x-request-id`) don't match.
-function isCatalogCacheKey(k: string): boolean {
-  return k.split("|").length === 6;
-}
-
-test("catalog cache Map keys must not contain the raw bearer API key (#10313)", async () => {
-  const probe = captureMapKeys();
-
-  try {
-    const request = new Request("http://localhost/v1/models", {
-      headers: { Authorization: `Bearer ${SECRET}` },
-    });
-    const res = await v1ModelsCatalog.getUnifiedModelsResponse(request);
-    assert.ok(res.status === 200 || res.status === 401 || res.status === 403);
-  } finally {
-    probe.release();
-  }
-
-  const catalogKeys = probe.keys.filter(isCatalogCacheKey);
-  assert.ok(
-    catalogKeys.length > 0,
-    "no catalog cache Map.set() calls observed — the probe did not exercise catalogCache/catalogInFlight"
-  );
-
-  const leaked = catalogKeys.filter((k) => k.includes(SECRET));
-  assert.deepEqual(
-    leaked,
-    [],
-    `catalog cache Map key retained the raw API key verbatim: ${JSON.stringify(leaked)} — ` +
-      `buildCatalogCacheKey() must hash the secret (e.g. sha256) before using it as a Map key`
-  );
-
-  assert.ok(catalogCacheMod.CATALOG_CACHE_TTL_MS_DEFAULT > 0);
-});
-
-test("cache keys embed the sha256 digest of the secret, never the raw secret (#10313)", async () => {
-  // Capture ALL Map keys emitted across BOTH requests (a 2nd identical-secret request
-  // may be a cache hit and emit no new catalog key — irrelevant here: we assert on the
-  // digest that did appear).
-  const probe = captureMapKeys();
-  try {
-    const resA = await v1ModelsCatalog.getUnifiedModelsResponse(
-      new Request("http://localhost/v1/models", {
-        headers: { Authorization: "Bearer sk-10313-DIGEST-A" },
-      })
-    );
-    const resB = await v1ModelsCatalog.getUnifiedModelsResponse(
-      new Request("http://localhost/v1/models", {
-        headers: { Authorization: "Bearer sk-10313-DIGEST-B" },
-      })
-    );
-    assert.ok(resA.status === 200 || resA.status === 401 || resA.status === 403);
-    assert.ok(resB.status === 200 || resB.status === 401 || resB.status === 403);
-  } finally {
-    probe.release();
-  }
-
-  const catalogKeys = probe.keys.filter(isCatalogCacheKey);
-  assert.ok(catalogKeys.length > 0, "expected catalog cache Map.set() calls");
-
-  const { createHash } = await import("node:crypto");
-  const digestA = createHash("sha256").update("sk-10313-DIGEST-A").digest("hex");
-  const digestB = createHash("sha256").update("sk-10313-DIGEST-B").digest("hex");
-  const rawA = "sk-10313-DIGEST-A";
-  const rawB = "sk-10313-DIGEST-B";
-
-  // The hashed fingerprint, not the raw secret, rides in the cache keys.
-  const keysWithDigestA = catalogKeys.filter((k) => k.includes(digestA));
-  const keysWithDigestB = catalogKeys.filter((k) => k.includes(digestB));
-  assert.ok(keysWithDigestA.length > 0, `expected a cache key embedding sha256 of A: ${catalogKeys.join(",")}`);
-  assert.ok(keysWithDigestB.length > 0, `expected a cache key embedding sha256 of B: ${catalogKeys.join(",")}`);
-
-  // Raw secrets must never appear (issue #10313 root cause).
-  assert.ok(!catalogKeys.some((k) => k.includes(rawA) || k.includes(rawB)));
-
-  // Identical secrets ⇒ identical key (memoized reuse); different ⇒ distinct.
-  assert.ok(keysWithDigestA.every((k) => k === keysWithDigestA[0]), "all A keys must be identical");
-  assert.ok(keysWithDigestB.every((k) => k === keysWithDigestB[0]), "all B keys must be identical");
-  assert.notEqual(keysWithDigestA[0], keysWithDigestB[0]);
-});

tests/unit/9147-catalog-eventloop-yield.test.ts

@@ -1,88 +0,0 @@
-import test from "node:test";
-import assert from "node:assert/strict";
-import fs from "node:fs";
-import os from "node:os";
-import path from "node:path";
-
-const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-9147-"));
-process.env.DATA_DIR = TEST_DATA_DIR;
-process.env.API_KEY_SECRET = process.env.API_KEY_SECRET || "catalog-9147-test-secret";
-
-const core = await import("../../src/lib/db/core.ts");
-const apiKeysDb = await import("../../src/lib/db/apiKeys.ts");
-const v1ModelsCatalog = await import("../../src/app/api/v1/models/catalog.ts");
-
-const CONNECTION_COUNT = 60;
-const MODELS_PER_CONNECTION = 12; // ~720 synced models total
-
-async function resetStorage() {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-  fs.mkdirSync(TEST_DATA_DIR, { recursive: true });
-  v1ModelsCatalog.__resetCatalogBuilderRunsForTest();
-}
-
-async function seedCatalogScaleDataset() {
-  const db = core.getDbInstance();
-  const now = new Date().toISOString();
-  const insertConn = db.prepare(
-    `INSERT INTO provider_connections (id, provider, auth_type, name, priority, is_active, api_key, created_at, updated_at)
-     VALUES (?, 'openai-compatible', 'apikey', ?, ?, 1, ?, ?, ?)`
-  );
-  const insertModels = db.prepare(
-    `INSERT INTO key_value (namespace, key, value) VALUES ('syncedAvailableModels', ?, ?)`
-  );
-  const seedTx = db.transaction(() => {
-    for (let i = 0; i < CONNECTION_COUNT; i++) {
-      const id = `probe-conn-${i}`;
-      insertConn.run(id, `probe-connection-${i}`, i, `sk-probe-${i}`, now, now);
-      const models = Array.from({ length: MODELS_PER_CONNECTION }, (_, m) => ({
-        id: `probe-model-${i}-${m}`,
-        name: `Probe Model ${i}-${m}`,
-        contextLength: 128000,
-      }));
-      insertModels.run(`openai-compatible:${id}`, JSON.stringify(models));
-    }
-  });
-  seedTx();
-}
-
-test.beforeEach(async () => {
-  await resetStorage();
-});
-
-test.after(async () => {
-  core.resetDbInstance();
-  apiKeysDb.resetApiKeyState();
-  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
-});
-
-test("#9147 — catalog build at catalog-scale must not pin the event loop for a long stretch", async () => {
-  await seedCatalogScaleDataset();
-  const req = new Request("http://localhost/v1/models");
-  let settled = false;
-  const buildPromise = v1ModelsCatalog.getUnifiedModelsResponse(req).then((res) => {
-    settled = true;
-    return res;
-  });
-  let lastTick = performance.now();
-  let maxGapMs = 0;
-  let ticks = 0;
-  while (!settled) {
-    await new Promise((resolve) => setTimeout(resolve, 0));
-    const now = performance.now();
-    maxGapMs = Math.max(maxGapMs, now - lastTick);
-    lastTick = now;
-    ticks++;
-    if (ticks > 20000) break;
-  }
-  const res = await buildPromise;
-  assert.equal(res.status, 200);
-  assert.ok(
-    maxGapMs < 150,
-    `event loop was blocked for ${maxGapMs.toFixed(1)}ms in a single stretch while building the ` +
-      `catalog for ${CONNECTION_COUNT} connections / ${CONNECTION_COUNT * MODELS_PER_CONNECTION} models ` +
-      `(${ticks} interleaved ticks observed) — the builder is not yielding to the event loop`
-  );
-});

tests/unit/combo-context-overflow-compression-probe.test.ts

@@ -0,0 +1,173 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import fs from "node:fs";
+import os from "node:os";
+import path from "node:path";
+
+/**
+ * #10225 — combo known-context-overflow must NOT hard-reject a compressible
+ * request before OmniRoute's compression pipeline can run.
+ *
+ * Root cause: getKnownContextOverflow() estimates the RAW body (ceil(serializedChars/4)
+ * over the whole Responses input[]) during combo target resolution, before any
+ * compression. When every known target limit is below that raw estimate, both call
+ * sites (round-robin + target-resolution) convert it into an immediate local 400
+ * `context_length_exceeded` with attempted:0 — so chatCore's proactive compression
+ * (which can shrink 294133→111529, 62% in the reporter's case) never runs. The only
+ * existing bypass (clientManagedResponsesContext) is gated to VERIFIED native Codex
+ * clients, so a generic Responses client (e.g. OpenCode) pointed at a codex model
+ * still hits the hard gate.
+ *
+ * Fix: thread a request-scoped `deferContextOverflowWhenCompressible` flag (set when
+ * the global compression switch is ON and not API-key opted-out). When set AND at
+ * least one target can run compression, getKnownContextOverflow returns null so the
+ * request reaches chatCore, whose post-compression enforceOutputTokenBudget becomes
+ * the final context gate — a local 400 only if the compressed body still cannot fit.
+ */
+
+const TEST_DATA_DIR = fs.mkdtempSync(path.join(os.tmpdir(), "omniroute-combo-overflow-compress-"));
+const ORIGINAL_DATA_DIR = process.env.DATA_DIR;
+process.env.DATA_DIR = TEST_DATA_DIR;
+
+const core = await import("../../src/lib/db/core.ts");
+const { saveModelsDevCapabilities, clearModelsDevCapabilities } =
+  await import("../../src/lib/modelsDevSync.ts");
+const { getKnownContextOverflow, handleComboChat } = await import(
+  "../../open-sse/services/combo.ts"
+);
+
+test.after(() => {
+  core.resetDbInstance();
+  if (ORIGINAL_DATA_DIR === undefined) {
+    delete process.env.DATA_DIR;
+  } else {
+    process.env.DATA_DIR = ORIGINAL_DATA_DIR;
+  }
+  fs.rmSync(TEST_DATA_DIR, { recursive: true, force: true });
+});
+
+test.beforeEach(() => {
+  clearModelsDevCapabilities();
+});
+
+function capabilityEntry(limitContext: number | null) {
+  return {
+    tool_call: true,
+    reasoning: false,
+    attachment: false,
+    structured_output: true,
+    temperature: true,
+    modalities_input: JSON.stringify(["text"]),
+    modalities_output: JSON.stringify(["text"]),
+    knowledge_cutoff: null,
+    release_date: null,
+    last_updated: null,
+    status: null,
+    family: null,
+    open_weights: false,
+    limit_context: limitContext,
+    limit_input: limitContext,
+    limit_output: 4096,
+    interleaved_field: null,
+  };
+}
+
+function target(modelStr: string) {
+  return {
+    kind: "model" as const,
+    stepId: modelStr,
+    executionKey: modelStr,
+    modelStr,
+    provider: modelStr.includes("/") ? modelStr.split("/")[0] : modelStr,
+    providerId: null,
+    connectionId: null,
+    weight: 1,
+    label: null,
+  };
+}
+
+// A generic Responses-API body whose estimate lands near `tokens` tokens (4 chars/token).
+// Uses `input:` (not `messages:`) to mirror the OpenCode/Codex Responses surface.
+function bigResponsesBody(tokens: number) {
+  return { input: [["user", "x".repeat(tokens * 4)]] };
+}
+
+const noopLog = { info() {}, warn() {}, error() {}, debug() {} };
+
+test("#10225 getKnownContextOverflow defers the hard overflow when compression is available", () => {
+  saveModelsDevCapabilities({ codex: { "gpt-5.6-terra": capabilityEntry(272_000) } });
+  const body = bigResponsesBody(275_000);
+
+  // Compression enabled + target can compress -> defer (null).
+  assert.equal(
+    getKnownContextOverflow([target("codex/gpt-5.6-terra")], body, {
+      deferContextOverflowWhenCompressible: true,
+    }),
+    null,
+    "compressible request must defer so chatCore compression can run (#10225)"
+  );
+
+  // Compression disabled -> the existing hard overflow is preserved (never lose #7177).
+  const hard = getKnownContextOverflow([target("codex/gpt-5.6-terra")], body);
+  assert.ok(hard);
+  assert.ok(hard.requiredContextTokens > hard.maxKnownContextTokens);
+
+  // Compression enabled but EVERY target is excluded from compression -> keep the hard gate.
+  const excluded = getKnownContextOverflow([target("codex/gpt-5.6-terra")], body, {
+    deferContextOverflowWhenCompressible: true,
+    compressionExclusions: ["gpt-5.6-terra"],
+  });
+  assert.ok(excluded, "fully-excluded targets must retain the hard preflight");
+});
+
+test("#10225 combo does not early-400 a compressible over-limit request when deferral is on", async () => {
+  saveModelsDevCapabilities({ codex: { "gpt-5.6-terra": capabilityEntry(272_000) } });
+  let dispatches = 0;
+
+  const response = await handleComboChat({
+    body: bigResponsesBody(275_000),
+    combo: {
+      name: "codex-compress-overflow",
+      strategy: "priority",
+      models: ["codex/gpt-5.6-terra"],
+    },
+    deferContextOverflowWhenCompressible: true,
+    clientManagedResponsesContext: false,
+    isModelAvailable: async () => true,
+    handleSingleModel: async () => {
+      dispatches += 1;
+      return new Response("ok", { status: 200 });
+    },
+    log: noopLog,
+  });
+
+  assert.notEqual(response.status, 400, "compression-enabled request must reach chatCore");
+  assert.equal(dispatches, 1, "must dispatch so chatCore compaction runs first");
+});
+
+test("#10225 combo keeps the fast 400 when compression is disabled", async () => {
+  saveModelsDevCapabilities({ codex: { "gpt-5.6-terra": capabilityEntry(272_000) } });
+  let dispatches = 0;
+
+  const response = await handleComboChat({
+    body: bigResponsesBody(275_000),
+    combo: {
+      name: "codex-compress-disabled",
+      strategy: "priority",
+      models: ["codex/gpt-5.6-terra"],
+    },
+    deferContextOverflowWhenCompressible: false,
+    clientManagedResponsesContext: false,
+    isModelAvailable: async () => true,
+    handleSingleModel: async () => {
+      dispatches += 1;
+      return new Response("ok", { status: 200 });
+    },
+    log: noopLog,
+  });
+
+  assert.equal(response.status, 400);
+  assert.equal(dispatches, 0, "#7177 anti-exhaustion guard must survive when compression is off");
+  const body = await response.json();
+  assert.equal(body.error.code, "context_length_exceeded");
+});

tests/unit/models-catalog-functional-gateway.test.ts

@@ -24,11 +24,11 @@ function makeRequest(query = ""): Request {
   return new Request(`http://localhost/v1/models${query}`);
 }
 
-test("catalog post-filters do not add mirrors when gate off (default)", async () => {
+test("catalog post-filters do not add mirrors when gate off (default)", () => {
   const models = [
     { id: "deepseek/deepseek-v4-flash", owned_by: "deepseek", root: "deepseek-v4-flash" },
   ];
-  const out = await applyCatalogPostFilters(makeRequest(), models, {
+  const out = applyCatalogPostFilters(makeRequest(), models, {
     connections: [],
     prefixMode: "dual",
     aliasToProviderId: {},
@@ -41,7 +41,7 @@ test("final catalog permission filtering does not let a mirror inherit base acce
   setFunctionalGatewayProviderSetting("agentrouter", "on");
 
   const models = [{ id: "kmc/k3", owned_by: "kimi-coding", root: "k3" }];
-  const withMirror = await applyCatalogPostFilters(makeRequest(), models, {
+  const withMirror = applyCatalogPostFilters(makeRequest(), models, {
     connections: [
       {
         id: "conn-1",
@@ -77,14 +77,14 @@ test("final catalog permission filtering does not let a mirror inherit base acce
   );
 });
 
-test("catalog post-filters synthesize a gateway mirror when gate on and gateway has a connection", async () => {
+test("catalog post-filters synthesize a gateway mirror when gate on and gateway has a connection", () => {
   setFeatureFlagOverride(FLAG_KEY, "true");
   setFunctionalGatewayProviderSetting("agentrouter", "on");
 
   const models = [
     { id: "deepseek/deepseek-v4-flash", owned_by: "deepseek", root: "deepseek-v4-flash" },
   ];
-  const out = await applyCatalogPostFilters(makeRequest(), models, {
+  const out = applyCatalogPostFilters(makeRequest(), models, {
     connections: [
       {
         id: "conn-1",