Reject unsupported reasoning efforts before proxying

containers/api-proxy/Dockerfile

@@ -59,7 +59,7 @@ COPY server.js logging.js metrics.js rate-limiter.js rate-limiter-window.js \
      token-tracker-http.js token-tracker-ws.js token-tracker-shared.js \
      model-resolver.js model-fallback.js model-fallback-chain.js model-utils.js model-body-rewriter.js proxy-utils.js oidc-adapter-utils.js adapter-factory.js anthropic-transforms.js claude-hosted-web.js codex-hosted-web.js hosted-web-policy.js \
      model-config.js key-validation.js server-factory.js startup.js \
-     proxy-request.js request-headers.js upstream-http.js proxy-guards.js proxy-error-handler.js http-client.js body-handler.js model-discovery.js management.js oidc-token-provider.js \
+     proxy-request.js request-headers.js upstream-http.js proxy-guards.js proxy-error-handler.js http-client.js body-handler.js reasoning-effort-validation.js model-discovery.js management.js oidc-token-provider.js \
      oidc-token-provider-base.js \
      github-oidc.js aws-oidc-token-provider.js aws-sigv4.js gcp-oidc-token-provider.js \
      anthropic-oidc-token-provider.js \

containers/api-proxy/reasoning-effort-validation.js

@@ -0,0 +1,58 @@
+'use strict';
+
+const { findRuntimeModel } = require('./runtime-model-catalog');
+
+function getReasoningEffort(parsed, url) {
+  let pathname;
+  try {
+    pathname = new URL(url, 'http://localhost').pathname.replace(/\/+$/, '');
+  } catch {
+    return null;
+  }
+
+  if (/\/chat\/completions$/.test(pathname)) {
+    return { field: 'reasoning_effort', value: parsed.reasoning_effort };
+  }
+  if (/\/responses$/.test(pathname)) {
+    return { field: 'reasoning.effort', value: parsed.reasoning?.effort };
+  }
+  if (/\/messages$/.test(pathname)) {
+    return { field: 'output_config.effort', value: parsed.output_config?.effort };
+  }
+  return null;
+}
+
+function getSupportedEfforts(model) {
+  if (Array.isArray(model?.supportedReasoningEfforts)) return model.supportedReasoningEfforts;
+  const supports = model?.capabilities?.supports;
+  if (Array.isArray(supports?.reasoning_effort)) return supports.reasoning_effort;
+  if (supports?.reasoningEffort === false) return [];
+  return null;
+}
+
+function validateReasoningEffort(body, provider, url) {
+  let parsed;
+  try {
+    parsed = JSON.parse(body.toString('utf8'));
+  } catch {
+    return;
+  }
+  if (!parsed || typeof parsed !== 'object' || Array.isArray(parsed) || typeof parsed.model !== 'string') return;
+
+  const requested = getReasoningEffort(parsed, url);
+  if (!requested || typeof requested.value !== 'string') return;
+  const model = findRuntimeModel(provider, parsed.model);
+  const supported = getSupportedEfforts(model);
+  if (!supported || supported.includes(requested.value)) return;
+
+  const error = new Error(
+    `${requested.field} ${JSON.stringify(requested.value)} is not supported by model ${parsed.model}; ` +
+    `supported values: [${supported.join(' ')}]`,
+  );
+  error.statusCode = 400;
+  error.type = 'invalid_request_error';
+  error.code = 'unsupported_reasoning_effort';
+  throw error;
+}
+
+module.exports = { validateReasoningEffort };

containers/api-proxy/reasoning-effort-validation.test.js

@@ -0,0 +1,56 @@
+'use strict';
+
+const { clearRuntimeModels, replaceRuntimeModels } = require('./runtime-model-catalog');
+const { validateReasoningEffort } = require('./reasoning-effort-validation');
+
+describe('validateReasoningEffort', () => {
+  afterEach(() => clearRuntimeModels());
+
+  it.each([
+    ['/v1/chat/completions', { reasoning_effort: 'short' }, 'reasoning_effort'],
+    ['/v1/responses', { reasoning: { effort: 'short' } }, 'reasoning.effort'],
+    ['/v1/messages', { output_config: { effort: 'short' } }, 'output_config.effort'],
+  ])('rejects an unsupported effort on %s', (url, effort, field) => {
+    replaceRuntimeModels('copilot', [{
+      id: 'gpt-5-mini',
+      supportedReasoningEfforts: ['low', 'medium', 'high'],
+    }]);
+
+    expect(() => validateReasoningEffort(
+      Buffer.from(JSON.stringify({ model: 'gpt-5-mini', ...effort })),
+      'copilot',
+      url,
+    )).toThrow(expect.objectContaining({
+      statusCode: 400,
+      code: 'unsupported_reasoning_effort',
+      message: `${field} "short" is not supported by model gpt-5-mini; supported values: [low medium high]`,
+    }));
+  });
+
+  it.each([
+    ['/v1/chat/completions', { reasoning_effort: 'high' }],
+    ['/v1/responses', { reasoning: { effort: 'high' } }],
+    ['/v1/messages', { output_config: { effort: 'high' } }],
+  ])('accepts an advertised effort on %s', (url, effort) => {
+    replaceRuntimeModels('copilot', [{
+      id: 'gpt-5-mini',
+      capabilities: { supports: { reasoning_effort: ['low', 'medium', 'high'] } },
+    }]);
+
+    expect(() => validateReasoningEffort(
+      Buffer.from(JSON.stringify({ model: 'gpt-5-mini', ...effort })),
+      'copilot',
+      url,
+    )).not.toThrow();
+  });
+
+  it('does not reject requests when model effort capabilities are unavailable', () => {
+    replaceRuntimeModels('copilot', [{ id: 'gpt-5-mini' }]);
+
+    expect(() => validateReasoningEffort(
+      Buffer.from(JSON.stringify({ model: 'gpt-5-mini', reasoning_effort: 'short' })),
+      'copilot',
+      '/v1/chat/completions',
+    )).not.toThrow();
+  });
+});

containers/api-proxy/server.token-steering.test.js

@@ -15,6 +15,8 @@ let getAndClearPendingTimeoutSteeringMessage;
 let injectSteeringMessage;
 let resetEffectiveTokenGuardForTests;
 let resetTimeoutSteeringForTests;
+let replaceRuntimeModels;
+let clearRuntimeModels;
 
 setupServerTestEnv(() => {
   ({ proxyRequest } = require('./server'));
@@ -25,13 +27,16 @@ setupServerTestEnv(() => {
     resetEffectiveTokenGuardForTests,
     resetTimeoutSteeringForTests,
   } = require('./proxy-request'));
+  ({ replaceRuntimeModels, clearRuntimeModels } = require('./runtime-model-catalog'));
   return {
     proxyRequest,
     getAndClearPendingSteeringMessage,
     getAndClearPendingTimeoutSteeringMessage,
     injectSteeringMessage,
     resetEffectiveTokenGuardForTests,
     resetTimeoutSteeringForTests,
+    replaceRuntimeModels,
+    clearRuntimeModels,
   };
 });
 
@@ -58,6 +63,7 @@ describe('token steering — getAndClearPendingSteeringMessage and injectSteerin
     delete process.env.AWF_AGENT_TIMEOUT_MINUTES;
     resetEffectiveTokenGuardForTests();
     resetTimeoutSteeringForTests();
+    clearRuntimeModels();
     jest.restoreAllMocks();
   });
 
@@ -249,6 +255,66 @@ describe('token steering — getAndClearPendingSteeringMessage and injectSteerin
     expect(systemMessages3).toHaveLength(0);
   });
 
+  it('rejects an unsupported effort after model routing and token steering', async () => {
+    replaceRuntimeModels('copilot', [{
+      id: 'gpt-5-mini',
+      supportedReasoningEfforts: ['low', 'medium', 'high'],
+    }]);
+    let responseHandler;
+    const upstreamReq = makeProxyReq();
+    jest.spyOn(https, 'request').mockImplementationOnce((_opts, cb) => {
+      responseHandler = cb;
+      return upstreamReq;
+    });
+
+    const firstReq = new EventEmitter();
+    firstReq.url = '/v1/chat/completions';
+    firstReq.method = 'POST';
+    firstReq.headers = { 'content-type': 'application/json' };
+    const firstRes = { headersSent: false, setHeader: jest.fn(), writeHead: jest.fn(), end: jest.fn() };
+    proxyRequest(firstReq, firstRes, 'api.githubcopilot.com', { Authorization: '******' }, 'copilot');
+    firstReq.emit('end');
+    await flushPromises();
+    completeUpstreamResponse(responseHandler, {
+      statusCode: 200,
+      body: { model: 'gpt-4o', usage: { prompt_tokens: 0, completion_tokens: 21 } },
+    });
+
+    const invalidBody = Buffer.from(JSON.stringify({
+      model: 'routed-model',
+      reasoning_effort: 'short',
+      messages: [{ role: 'user', content: 'Second request' }],
+    }));
+    const req = new EventEmitter();
+    req.url = '/v1/chat/completions';
+    req.method = 'POST';
+    req.headers = { 'content-type': 'application/json', 'content-length': String(invalidBody.length) };
+    const res = { headersSent: false, setHeader: jest.fn(), writeHead: jest.fn(), end: jest.fn() };
+    const routeToMini = body => {
+      const parsed = JSON.parse(body.toString('utf8'));
+      parsed.model = 'gpt-5-mini';
+      return Buffer.from(JSON.stringify(parsed));
+    };
+
+    proxyRequest(req, res, 'api.githubcopilot.com', { Authorization: '******' }, 'copilot', '', routeToMini);
+    req.emit('data', invalidBody);
+    req.emit('end');
+    await flushPromises();
+
+    expect(https.request).toHaveBeenCalledTimes(1);
+    expect(getAndClearPendingSteeringMessage()).toBeNull();
+    expect(res.writeHead).toHaveBeenCalledWith(400, expect.objectContaining({
+      'Content-Type': 'application/json',
+    }));
+    expect(JSON.parse(res.end.mock.calls[0][0])).toMatchObject({
+      error: {
+        type: 'invalid_request_error',
+        code: 'unsupported_reasoning_effort',
+        message: 'reasoning_effort "short" is not supported by model gpt-5-mini; supported values: [low medium high]',
+      },
+    });
+  });
+
   it('does not inject any warning when AWF_ENABLE_TOKEN_STEERING is not set', async () => {
     // Disable token steering for this test
     delete process.env.AWF_ENABLE_TOKEN_STEERING;

containers/api-proxy/upstream-http.js

@@ -8,6 +8,8 @@ const {
   selectNextFallbackModel,
   rewriteRequestModel,
 } = require('./model-fallback-chain');
+const { validateReasoningEffort } = require('./reasoning-effort-validation');
+const { sanitizeForLog } = require('./logging');
 
 /**
  * Backoff delays (ms) between successive model-not-supported retries.
@@ -62,6 +64,37 @@ function createSendUpstreamRequest({
     codexCompatibility = null,
     attemptedModels = null,
   }) {
+    try {
+      validateReasoningEffort(body, provider, upstreamPath);
+    } catch (err) {
+      if (err.code !== 'unsupported_reasoning_effort') throw err;
+      if (res.headersSent) return;
+
+      const statusCode = err.statusCode || 400;
+      const duration = Date.now() - startTime;
+      metrics.gaugeDec('active_requests', { provider });
+      metrics.increment('requests_total', { provider, method: req.method, status_class: '4xx' });
+      logRequest?.('warn', 'request_validation_failed', {
+        request_id: requestId,
+        provider,
+        method: req.method,
+        path: sanitizeForLog(req.url),
+        status: statusCode,
+        duration_ms: duration,
+        error_code: err.code,
+      });
+      otel.endSpan(span, statusCode);
+      res.writeHead(statusCode, { 'Content-Type': 'application/json', 'X-Request-ID': requestId });
+      res.end(JSON.stringify({
+        error: {
+          message: err.message,
+          type: err.type || 'invalid_request_error',
+          code: err.code,
+        },
+      }));
+      return;
+    }
+
     const isRoutingClassifier = req.awfRequestContext?.purpose === 'routing_classification';
     const cancellationSignal = isRoutingClassifier
       ? req.awfRequestContext.signal

containers/api-proxy/upstream-http.test.js

@@ -3,8 +3,11 @@ const {
   MODEL_NOT_SUPPORTED_RETRY_DELAYS_MS,
   rebuildBodyFramingHeaders,
 } = require('./upstream-http');
+const { clearRuntimeModels, replaceRuntimeModels } = require('./runtime-model-catalog');
 
 describe('upstream-http', () => {
+  afterEach(() => clearRuntimeModels());
+
   test('rebuilds body framing headers case-insensitively', () => {
     expect(rebuildBodyFramingHeaders({
       'Content-Length': '10',
@@ -271,6 +274,70 @@ describe('upstream-http', () => {
     }));
   });
 
+  test.each(['ordered fallback', 'endpoint-blocked fallback'])(
+    'rejects unsupported reasoning effort after %s rewrites the model',
+    (fallbackType) => {
+      replaceRuntimeModels('copilot', [
+        { id: 'initial-model', supportedReasoningEfforts: ['low', 'high'] },
+        { id: 'fallback-model', supportedReasoningEfforts: ['low'] },
+      ]);
+      const proxyReq = { on: jest.fn(), write: jest.fn(), end: jest.fn() };
+      const responseCallbacks = [];
+      const httpsRequest = jest.fn((_options, cb) => {
+        responseCallbacks.push(cb);
+        return proxyReq;
+      });
+      const handleUpstreamResponse = jest.fn();
+      const res = { headersSent: false, writeHead: jest.fn(), end: jest.fn() };
+      const sendUpstreamRequest = createSendUpstreamRequest({
+        https: { request: httpsRequest },
+        proxyAgent: {},
+        handleUpstreamResponse,
+        sleep: jest.fn(),
+        otel: { endSpanError: jest.fn(), endSpan: jest.fn() },
+        handleRequestError: jest.fn(),
+        metrics: { gaugeDec: jest.fn(), increment: jest.fn(), observe: jest.fn() },
+        getFallbackModels: () => ['fallback-model'],
+      });
+      const req = {
+        method: 'POST',
+        url: '/v1/chat/completions',
+        ...(fallbackType === 'endpoint-blocked fallback'
+          ? { awfModelCandidates: ['initial-model', 'fallback-model'] }
+          : {}),
+      };
+      const body = Buffer.from(JSON.stringify({
+        model: 'initial-model',
+        reasoning_effort: 'high',
+        messages: [],
+      }));
+
+      sendUpstreamRequest({ 'content-length': String(body.length) }, createContext({
+        body,
+        requestBytes: body.length,
+        req,
+        res,
+      }));
+
+      if (fallbackType === 'ordered fallback') {
+        const errorHandler = proxyReq.on.mock.calls.find(([event]) => event === 'error')[1];
+        errorHandler(new Error('ECONNRESET'));
+      } else {
+        responseCallbacks[0]({ statusCode: 400, headers: {} });
+        handleUpstreamResponse.mock.calls[0][2].onModelEndpointBlockedRetry();
+      }
+
+      expect(httpsRequest).toHaveBeenCalledTimes(1);
+      expect(res.writeHead).toHaveBeenCalledWith(400, expect.any(Object));
+      expect(JSON.parse(res.end.mock.calls[0][0])).toMatchObject({
+        error: {
+          code: 'unsupported_reasoning_effort',
+          message: 'reasoning_effort "high" is not supported by model fallback-model; supported values: [low]',
+        },
+      });
+    },
+  );
+
   test('carries Codex compatibility metadata forward across the endpoint-blocked retry', () => {
     const proxyReq = { on: jest.fn(), write: jest.fn(), end: jest.fn() };
     const responseCallbacks = [];