fix(router): pin combo child routes to concrete targets

[luvs01]

Summary

• Resolve already-selected combo children as concrete provider/model targets instead of consulting public combo aliases again.
• Apply the concrete route consistently to encrypted-task eligibility, target capability lookup, and recursive child dispatch.
• Add an end-to-end regression proving a shadowing alias cannot redirect the selected child or its request payload.

The router already bypasses combo and policy aliases when it first resolves a selected target. The Responses combo path later called the public alias-aware resolver again, which could move the child to a different configured provider.

Verification

• bun test tests/server-combo-failover-e2e.test.ts — 47 passed, 0 failed.
• bun test tests/router.test.ts tests/combos.test.ts — 59 passed, 0 failed.
• bun run typecheck — passed.
• bun run privacy:scan — passed.
• git diff --check — passed.
• Two independent focused diff reviews found no actionable P0–P3 findings.
• Full bun run test was attempted once. On Windows, Bun 1.3.14 panicked with an internal assertion after 287 seconds in the storage-policy area; the changed routing/combo suites did not fail.

Checklist

• Scope stays focused and avoids unrelated cleanup.
• Docs or release notes were updated when needed. No user-facing configuration or API contract changed.
• Security-sensitive changes were reviewed for secrets, auth, and unsafe defaults.

Review readiness checklist

This PR stays in draft until every box below is ticked. Tick all four boxes once the requirements are met:

• All CI tests are green on my local testing.

• I pushed my PR to the latest dev commit.

• I resolved all correct Codex and CodeRabbit findings.

• My PR is ready for review.

Summary by CodeRabbit

• Bug Fixes

  • Improved routing when a provider/model target shares a name with a combo alias.
  • Ensured explicitly selected targets are sent directly to the intended provider.
  • Prevented unintended providers from receiving requests during combo failover.
  • Preserved the requested prompt and model throughout failover scenarios.

• Tests

  • Added end-to-end coverage for routing concrete targets when aliases overlap.

[coderabbitai]

Important

Review skipped

No new commits to review since the last review.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 40fd7a10-994f-4cb2-962e-9ac98f89a2c8

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

📝 Walkthrough

Walkthrough

The change adds concrete model routing that bypasses combo aliases and policy evidence. Combo validation, child dispatch, and combo attempts use this route. Regular requests retain policy-aware routing. An end-to-end test covers a shadowing combo alias.

Changes

Concrete combo target routing

Layer / File(s)	Summary
Concrete model routing API src/router.ts	Exports routeConcreteModel for explicit provider/model targets without combo alias resolution or policy evidence.
Combo routing integration and validation src/server/responses/core.ts, tests/server-combo-failover-e2e.test.ts	Combo target checks, child dispatch, and combo attempts use concrete routing. Regular requests continue to use evidence-aware routeModel. The end-to-end test verifies dispatch to provider a with model m1 when a combo alias shadows the selector.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• lidge-jun/opencodex#671: Both changes add explicit model-routing behavior in src/router.ts.
• lidge-jun/opencodex#1003: Both changes modify combo routing and failover coverage.
• lidge-jun/opencodex#1012: Both changes distinguish concrete model routing from combo- and policy-aware routing.

Suggested labels: review-ready

Suggested reviewers: lidge-jun, ingwannu

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: routing combo child selections to concrete provider/model targets.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[github-actions]

✅ Deterministic PR hygiene checks passed.

[github-actions]

✅ READY

• all PR quality gates passed; the review readiness checklist is complete.

Review readiness checklist

• ✅ All CI tests are green on my local testing.
• ✅ I pushed my PR to the latest dev commit.
• ✅ I resolved all correct Codex and CodeRabbit findings.
• ✅ My PR is ready for review.

✅ 4/4 boxes ticked.

This pull request has been marked Ready for Review.
The review-ready label marks this PR as ready; review automation runs independently. If no CodeRabbit review appears, comment @coderabbitai review to request one.
Maintainers notified: @lidge-jun @Ingwannu @Wibias

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tests/server-combo-failover-e2e.test.ts`:
- Around line 384-397: Update the regression test setup around comboConfig so
config.defaultProvider is set to "b" after creation, while preserving the shadow
combo target as "a/m1". Ensure the request cannot independently resolve bare
model "m1" to provider "a", so the test only passes when the child request
retains the explicit provider qualifier and routes through the intended combo
target.

🪄 Autofix

❌ Autofix failed (check again to retry)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: ASSERTIVE

Plan: Pro Plus

Run ID: 2f790653-ef0a-420f-8f4d-4f2a65df765d

📥 Commits

Reviewing files that changed from the base of the PR and between d517161 and b3a29d6.

📒 Files selected for processing (3)

• src/router.ts
• src/server/responses/core.ts
• tests/server-combo-failover-e2e.test.ts

[coderabbitai]

An unexpected error occurred while generating fixes: Not Found - https://docs.github.com/rest/git/refs#get-a-reference

[coderabbitai]

@github-actions[bot] The pull request is ready for review. I will review the changes in #1379.

⚠️ Action not completed

Already reviewed.

Note: CodeRabbit is an incremental review system and does not re-review already reviewed commits. This command is applicable only when automatic reviews are paused.

[Wibias]

Thanks @luvs01! Nice targeted routing fix, and the regression makes the provider-pinning contract much clearer. Appreciate the quick review iteration. Merged. 🙏