Support "auto" model for Pi and Codex via provider-prefix stripping - #8500
Conversation
…Codex Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
…gging Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
Co-authored-by: lpcox <15877973+lpcox@users.noreply.github.com>
There was a problem hiding this comment.
🟡 Changes recommended
Prefix stripping currently affects non-Copilot adapters and can corrupt valid namespaced model IDs for custom upstreams.
Get a fresh assessment by requesting another Copilot review.
Pull request overview
Adds provider-prefix normalization so Pi and Codex can use copilot/auto through the API proxy.
Changes:
- Adds shared prefix-stripping logic and request-body integration.
- Updates model resolution and tests.
- Documents Copilot
autosupport.
File summaries
| File | Description |
|---|---|
docs/api-proxy-sidecar.md |
Documents Copilot auto behavior. |
containers/api-proxy/model-utils.js |
Adds prefix normalization helper. |
containers/api-proxy/model-utils.test.js |
Tests normalization behavior. |
containers/api-proxy/model-resolver.js |
Normalizes models before resolution. |
containers/api-proxy/model-resolver.test.js |
Tests prefixed model resolution. |
containers/api-proxy/model-body-rewriter.js |
Adds body-level normalization. |
containers/api-proxy/model-body-rewriter-prefix.test.js |
Tests request-body rewriting. |
containers/api-proxy/body-handler.js |
Applies normalization to writable requests. |
Review details
- Files reviewed: 8/8 changed files
- Comments generated: 2
- Review effort level: Balanced (auto)
Note
Copilot is running an experiment and ran this review at Balanced.
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
✅ Copilot review passed with no inline comments. @copilot Add the |
Documentation PreviewDocumentation has been built for this PR. To view locally:
Built from commit 51fab88 |
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
|
🛡️ Smoke Copilot Network Isolation confirmed the egress allowlist is enforced. ✅ Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ Smoke Copilot BYOK completed. Copilot BYOK mode operational. 🔓
|
|
📡 Smoke OTel Tracing completed. All tracing scenarios validated. ✅
|
|
🔌 Smoke Services — All services reachable! ✅
|
|
✨ The prophecy is fulfilled... Smoke Codex has completed its mystical journey. The stars align. 🌟 Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
|
Chroot tests passed! Smoke Chroot - All security and functionality tests succeeded.
|
|
✅ Build Test Suite completed successfully!
|
|
📰 VERDICT: Smoke Copilot has concluded. All systems operational. This is a developing story. 🎤
|
|
✅ Smoke Claude passed Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
❌ Smoke Copilot BYOK AOAI (api-key) reports failed. AOAI BYOK (api-key) mode investigation needed...
|
|
❌ Smoke Copilot BYOK AOAI (Entra) reports failed. AOAI BYOK (Entra) mode investigation needed...
|
|
📰 DEVELOPING STORY: Smoke Docker Sbx reports failed. Our correspondents are investigating the incident...
|
|
✅ Security Guard completed successfully! Security review of PR #8500 ("Support 'auto' model for Pi and Codex via provider-prefix stripping") is complete. Finding: No security vulnerabilities detected. The PR implements safe, transparent model-name normalization:
This is a feature-enablement PR with no security regression.
|
|
❌ Smoke Gemini reports failed. Facets need polishing...
|
Smoke Test: Claude Engine Validation
Overall result: PASS Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "api.anthropic.com"See Network Configuration for more information.
|
|
Smoke Test: Copilot Engine —
Overall: PASS
|
|
EGRESS_RESULT allow=pass deny=pass ✅ Allowed domain (api.github.com) reachable: Overall: PASS cc Warning Firewall blocked 1 domainThe following domain was blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "example.com"See Network Configuration for more information.
|
|
✅ GitHub MCP: PR list OK (2 merged PRs fetched) Status: PASS — Direct BYOK mode (COPILOT_PROVIDER_API_KEY) via api-proxy → api.githubcopilot.com Triggered by
|
✅ Coverage Check PassedOverall Coverage
📁 Per-file Coverage Changes (1 files)
Coverage comparison generated by |
Smoke Test: Services Connectivity
Overall: PASS
|
📡 OTel Tracing Smoke Test Results
Overall: All scenarios pass. No regression detected.
|
Chroot Version Comparison Results
|
|
Smoke test: FAIL
Warning Firewall blocked 7 domainsThe following domains were blocked by the firewall during workflow execution:
To allow these domains, add them to the network:
allowed:
- defaults
- "accounts.google.com"
- "android.clients.google.com"
- "clients2.google.com"
- "contentautofill.googleapis.com"
- "msfeed25.pkgs.visualstudio.com"
- "www.google.com"
- "www.gstatic.com"See Network Configuration for more information.
|
🏗️ Build Test Suite Results
Overall: 8/8 ecosystems passed — PASS All 18 test projects across Bun, C++, Deno, .NET, Go, Java, Node.js, and Rust built/installed successfully and all tests passed. No errors encountered. Note: Java builds required
|
…cation-architecture Codex's OpenAI-native auto limitation was documented, but the authentication-architecture guide did not note that Copilot's own auto selector (including the copilot/auto LiteLLM-style alias used by Codex and Pi) is unaffected and supported via api-proxy prefix stripping (stripRedundantProviderPrefix, shipped in #8500). This was already documented in docs/api-proxy-sidecar.md but missing here, causing a cross-document inconsistency. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
…cation-architecture (#8505) Codex's OpenAI-native auto limitation was documented, but the authentication-architecture guide did not note that Copilot's own auto selector (including the copilot/auto LiteLLM-style alias used by Codex and Pi) is unaffected and supported via api-proxy prefix stripping (stripRedundantProviderPrefix, shipped in #8500). This was already documented in docs/api-proxy-sidecar.md but missing here, causing a cross-document inconsistency. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Pi, Codex, and similar harnesses configure models using LiteLLM-style
"provider/model"naming (e.g.copilot/auto) even when already talking to that exact provider. The api-proxy sidecar forwarded this literal string upstream unmodified, so Copilot rejectedcopilot/autoas an unrecognized model instead of resolving it via its existingautoselector.Root cause
autopass-through only fired for the bare string"auto", and was only reachable whenAWF_MODEL_ALIASESwas configured (makeModelBodyTransform()returnsnullotherwise) — so it was effectively dead code for the common case of a user not configuring aliases."<provider>/"self-reference prefix in the request body'smodelfield.Fix
model-utils.js: addedstripRedundantProviderPrefix(model, provider)— strips a"<provider>/"prefix only when it case-insensitively matches the current provider, leaving cross-provider references (e.g.openai/gpt-4while talking to Copilot) untouched.model-resolver.js:resolveModel()now normalizes the requested model with this helper before alias/direct-match resolution, socopilot/autohits the existingautopass-through andcopilot/gpt-4oresolves as a direct match.model-body-rewriter.js/body-handler.js: addedstripRedundantModelPrefixInBody(), wired in as an always-on step in the request pipeline — independent ofAWF_MODEL_ALIASES— so the prefix is stripped even when no aliasing is configured at all.Docs
docs/api-proxy-sidecar.md: clarified that Copilot'sauto(andcopilot/auto) is supported through the Copilot provider path for Codex/Pi, distinct from the pre-existing OpenAI-nativeautolimitation.