[115dkk]

What this is for

Two refactors from an architecture review of main plus #91, and a fix for the Windows CI job.

1. A request's kind is decided once (review candidate 1). Whether a request is an Auto mode classifier stage, a web search, a web fetch or an ordinary turn used to be worked out on several lines of proxy.ts, and the answer stopped there: the provider adapters never saw it. Now it is decided once, carried on the route, and read by the adapters. That fixes a defect. ARCHITECTURE §2 promises that the classifier's security prompt reaches its target intact, but every translated provider added to it. A classifier request routed to ChatGPT got this in front of the security prompt, and the image-generation hint (a curl recipe) after it:

   You are gpt-6-luna (reasoning effort: high), answering through Claude Code, a terminal-based coding agent.
   

   The OpenAI-compatible, Google, Grok and Anthropic-compatible paths added the identity line and instructionsAppend. Nothing in the logs showed it.

2. What a provider can do is answered in one module (candidate 3). "Can this provider take routed requests", "who declares this model id", "which efforts does it take" and "can it run web search" were each answered in several places, in two spellings for the first. targets.ts answers all four.

   • It also pays down one piece of tech debt the review found. A primary route or a direct rule naming an ingress-only provider was accepted by validate and then dropped by routing without a word. It is still accepted, because refusing it would break configs that load today. But the config save now answers with a warning for each such rule, and the router logs it when it reads the config.

3. The suite passes on windows-latest. main's Windows job fails 19 tests, and the causes are listed below. Fixing them turned up four product bugs on Windows, also fixed here.

Depends on #91. This branch is built on #91's and merges it again after each of #91's updates, so #91's commits and the main they merge show here too.

Review document

The review, with a before/after flow graph for each candidate, is in this PR at docs/reviews/2026-10-24-architecture-review.md. This PR carries its candidates 1 and 3.

Before

flowchart TB
  REQ([Messages request]) --> H["proxy.ts handle()"]
  H -->|"purpose check"| REC[(requests.jsonl)]
  H --> RES["resolve()"]
  H -->|"the same rules again"| UR["unroutableReason()"]
  RES -->|"Resolved: provider, model, tag"| AD{adapter}
  AD --> CG["chatgpt: adds identity line + image hint"]
  AD --> OG["other translated providers: add identity + addendum"]
  RES -.->|"splits the tag string"| FO[failover]
  H & AD & RT2[agents · model scores · validate · admin] --> Q{{"routable target? two spellings, a dozen places"}}
  classDef leak stroke:#c62f2f,stroke-width:2px,color:#c62f2f;
  class UR,CG,OG,FO,Q leak

Loading

After

flowchart TB
  REQ([Messages request]) --> K["requestKind()"]
  K -->|kind| D["decide()"]
  D -->|"route: kind, asked"| AD{adapter}
  D -->|refusal| X[400 refused]
  D -->|"no route"| PASS[passed to Anthropic as is]
  AD --> PA["promptAdditions(kind)"]
  PA -->|"classifier: nothing added"| CG[chatgpt · translated providers]
  D -->|asked| FO[failover]
  D & AD & RT2[agents · model scores · validate · admin] --> T["targets.ts"]
  classDef deep fill:#15243a,stroke:#15243a,color:#e8eef7,stroke-width:3px;
  class K,D,PA,T deep

Loading

What changes

Request kind (candidate 1)

• routing.ts
  • RequestKind (web-search, web-fetch, auto-mode-classifier, turn) and requestKind(json, pathname), whose order is the precedence.
  • Resolved carries kind and asked (the model id the client sent).
  • decide(model, body, cfg, kind) returns the route, or the reason to refuse it, in one pass. resolve() stays for its other callers as decide(…).route.
  • unroutableReason, which re-implemented resolve's rules to explain them, is gone. Every way of finding no route ends in one noRoute(), which applies the refusal rules in the order unroutableReason applied them, including 모델명 중복으로 호출이 안 되는 문제(Opencode Go 관련) #94's qualified ids and the pass-through for Claude requests with a delegation marker.
• identity.ts: promptAdditions(kind, provider, imageHint?) is the one rule for what a routed system prompt may gain. A classifier request gains nothing.
• The adapters (ChatGPT, OpenAI-compatible, Google, Grok) and the Anthropic-compatible branch take the kind. proxy.ts computes it once, calls decide once, and failover names asked instead of splitting the log tag.

Provider capabilities (candidate 3)

• targets.ts
  • isTargetProvider / ingressOnly: one spelling of the target rule, accountPool: true with auth: "claude-code".
  • declaredBy, qualifiedModel, rawDeclaredBy, soleOwner: moved from routing.ts, still re-exported there.
  • effortLevels: moved out of the HTTP module the proxy imported it from, still re-exported from admin.ts.
  • runsServerTools / answersWebSearch: the proxy's canRunServerTools and the admin's hand-copied mirror of it become one implementation.
  • targetWarnings: the save warning and the load-time log line described above.
• The router's callers (routing, validate, the proxy, agent files, model scores, the admin status) use it instead of spelling the rule themselves.
• The dashboard needs the answer for providers not saved yet, so it keeps one copy, isTargetProvider in app.js, in place of three inline checks. ui-targets.test.ts holds that copy to the router's for every provider shape.

Windows CI

Same folder, different spelling. The runner's TEMP is the 8.3 alias C:\Users\RUNNER~1\…, while the product records the native long form, and on Windows the installation home in lowercase. The fixtures now resolve their roots with fs.realpathSync.native and compare through the product's normalizeHome. The desktop-legacy fixture also sets USERPROFILE, which os.homedir() reads on Windows.

Other test-side causes:

• A file name Windows forbids. The darwin and linux launcher simulations made a home with a double quote in its name. On a Windows host they drop only the quote and keep the other hostile characters. The one step that checks a symlinked home runs only off Windows, because normalizeHome resolves links for POSIX homes and compares Windows paths as text.
• Browse listing. The browse test expected the listing without the drive entries the server lists first on Windows (folders.test.ts already covers those).
• Replacement race. The test swapped the folder only when the reader opened one exact spelling of the path. It now swaps on either spelling, and on Windows it swaps in a junction, so it also runs on accounts without symlink privilege.

Product bugs on Windows the failures exposed:

• images.ts, two causes of a wrongly blocked image.
  • The session-temp and allowed-root checks mixed TEMP's 8.3 spelling with the long form and compared paths case by case. They now check the native long form, Windows paths compare without case, and TEMP itself is still refused when it is a junction.
  • The folder owner had to be the current user, but an elevated administrator's new folders belong to Administrators. The owner may now be the user, SYSTEM or Administrators, the principals the same check already trusts in its access rules. A folder another ordinary user owns, or one anyone else can write to, is still refused.
• tray.ts: on Windows renameSync replaces an existing file, so an occupied backup path let the swap replace the working runtime. The swap now refuses an occupied backup path.
• launcher.ts: removing the tray launcher uses unlinkSync, because fs.rmSync({ force: true }) on a hostile file name ended the Node 24.1 process with 0xC0000409.

The workflow's comment says to drop continue-on-error for Linux and Windows once they pass. I left that to you.

Behaviour

Unchanged apart from the fixes above, plus four notes:

• The ChatGPT path now trims instructionsAppend the way the other providers already did. An addendum with leading or trailing whitespace changes once, which costs one prompt-cache miss.
• A config with accountPool: true and an auth other than claude-code is refused by validate but adopted at startup. It is now ingress-only everywhere; before, routing treated it as a target and the proxy then answered 400.
• The config save's warning may now hold several lines: the model-slot warning first, then one line per ignored route or direct rule.
• A prefix rule that names an ingress-only provider is still ignored, and a marker naming a model that nothing can take is still refused by name rather than sent to Anthropic as a 404.

Found, not changed

Reading every call site for candidate 3 turned up places where two parts of the code answer the same question differently. Changing them changes behaviour, so they are listed here rather than changed:

• ConfigStore.reload adopts an invalid config on first load, so the guarantees validate gives do not hold at startup.
• Dashboard vs router.
  • The dashboard matches model ids exactly; the router matches dated and undated forms.
  • The dashboard has no notion of provider:model ids, and writes direct prefix rules instead.
  • Direct rules: the router takes the first match in array order, the dashboard the longest prefix.
  • The dashboard's ChatGPT fallback list lacks ultra for gpt-6.1-sol.
  • The anthropic and google effort ladders differ between the two.
• Web search.
  • validate accepts any provider as webSearch.
  • An openai-compatible backend is served through its web plugin, though the status says it cannot search.
  • An anthropic pool provider can search natively, but serveWebSearch gives it no backend role.
• normalizeHome compares Windows paths as text, so a junction or an 8.3 spelling of the same home reads as another installation.

Verification

Where	tests	pass	fail	skipped
windows-latest at ffe90c8	2405	2362	0	43
This machine (Windows 11)	2405	2350	7	48

On this machine, seven tests fail, and none of them fails on the runners:

• Five need symlink privilege, which this account does not have: the four session-folder tests and the untracked-symlink diff test.
• Windows self-purge waits for its Node process… depends on timing. It passes when its file runs alone.
• loopback idle timeout closes a stalled response body answers 503 here on main too, with or without proxy variables, and passes on all three runners. I did not dig further.

On the runners, all three jobs pass at ffe90c8. The Windows job went from 19 failures (main) to 5 at d4d5736 and to none at ffe90c8, which confirms the elevated-owner cause of the last two image failures. npm run typecheck and git diff --check pass.

decide() was compared with #91's resolve() and unroutableReason() over 41,664 combinations of config, model and body: 16,124 routed, 10,545 passed through, and the rest refused with all five messages. There were no differences.

New tests:

• requestKind precedence and kind/asked on every kind of route (routing.test.ts).
• promptAdditions (identity.test.ts).
• A classifier request's system text arriving byte for byte on ChatGPT, both OpenAI-compatible wires, Gemini and an Anthropic-compatible upstream with an addendum configured.
• targets.test.ts, ui-targets.test.ts, and the warning on a config save (admin.test.ts).

🤖 Generated with Claude Code

[PBJ-2]

Thank you for tracking down the classifier prompt additions and for consolidating both the routing decision and the provider capability rules. I reviewed what #98 adds on top of #91 and tested a merge with current main (6158026). I found no blocking issues in the refactor itself.

1. The prompt-integrity defect is real, and the fix works. On current main the translated paths add identity/addendum text, and ChatGPT adds an image hint, in front of the classifier's security prompt. The merged tree keeps the classifier system text intact. I also checked real local HTTP upstream requests through both OpenAI wires, Google and Grok; ChatGPT and Anthropic-compatible are covered by the existing adapter and proxy tests.
2. The merge and regression checks are green. The merge is conflict-free; typecheck, check:mod and the full suite pass (2,695 tests: 2,679 passed, 16 skipped, 0 failed). A 35,840-case routing/refusal comparison against main found no differences, and 90 serialization comparisons for ordinary, search and fetch requests matched apart from the existing random per-turn ID. That checks prefix stability, not a live cache-hit measurement.
3. Two optional test improvements. In packages/cli/test/launcher.test.ts:56, the symlink-capability skip also skips the unrelated legacy-ownership assertions; splitting them would keep that coverage on accounts without symlink privileges. The classifier tests in openai-translate.test.ts:228 and google-translate.test.ts:44 call promptAdditions directly, so an adapter-level test would better protect the hand-off of the request kind.

The Windows CI test step genuinely succeeds here, not just under continue-on-error.

One thing gates the merge: this branch contains #91, which still has the save race described in my review there. Once that fix lands (in #91, then merged into this branch), this is ready to merge. The test improvements above are non-blocking.

[PBJ-2]

#91 is merged now. Could you merge current main into this branch so the diff shows only the refactor and the Windows fixes? Once that's green, I'll merge this as reviewed.

[115dkk]

Merged current main (0.12.21, with #91) in d2a9197, so the diff against main is now the refactor and the Windows fixes only. The merge had no textual conflicts, but main's harness from 495df86 runs the page's own renderAutoClassifier, which on this branch calls isTargetProvider; c7d7857 slices that function from app.js into the harness as well.

Both optional test improvements are in:

• 241b392: the launcher's legacy-evidence and unknown-file assertions run on accounts without symlink privileges. The linked-home check is its own test, skipped on Windows as before.
• ba4669b: the OpenAI (both wires), Google and Grok adapter tests pass requestKind() into handle(), as the ChatGPT one does. A classifier request's system text reaches the upstream exactly as sent, and an ordinary turn through the same adapter still gets the identity line and the addendum. Changing either adapter to ignore the kind fails them.

Typecheck and check:mod pass locally; CI on c7d7857 is running.