fix(vision-bridge): lock unsupported models on 400

changelog.d/fixes/18271-vision-bridge-400-lockout.md

@@ -0,0 +1 @@
+- **fix(vision-bridge):** lock the rejected provider/connection/model after a model-scoped 400 so later selections skip it while fallback continues ([#18271](https://github.com/cheaper-inference/OmniRoute/pull/18271)) — thanks @RaviTharuma

src/lib/guardrails/visionBridgeHelpers.ts

@@ -10,6 +10,8 @@ import { getBestVisionModel, getFallbackModels, recordLatency } from "./visionBr
 import { combineCredentialChecks } from "./visionBridgeKeyScope";
 import { REGISTRY } from "@omniroute/open-sse/config/providers";
 import { fetch as undiciFetch } from "undici";
+import { isModelScoped400 } from "@omniroute/open-sse/services/modelAccessDenied.ts";
+import { lockModel } from "@omniroute/open-sse/services/accountFallback.ts";
 /**
  * Provider to environment variable mapping for API key resolution.
  */
@@ -889,6 +891,19 @@ async function callVisionModelSingle(
 
     if (!response.ok) {
       const errorText = await response.text().catch(() => "Unknown error");
+      if (response.status === 400 && isModelScoped400(errorText)) {
+        const connectionId = response.headers.get("x-omniroute-selected-connection-id")?.trim();
+        const separator = config.model.indexOf("/");
+        if (connectionId && separator > 0) {
+          lockModel(
+            config.model.slice(0, separator),
+            connectionId,
+            config.model.slice(separator + 1),
+            "model_capacity",
+            60 * 60 * 1000
+          );
+        }
+      }
       throw new Error(`Vision API error ${response.status}: ${errorText}`);
     }
 

src/lib/guardrails/visionBridgeRouter.ts

@@ -246,6 +246,27 @@ async function isModelUsableGivenLockouts(
   return false;
 }
 
+/**
+ * A fixed model is selectable unless its credential check is a confirmed `false`
+ * or every known connection for it is locked out (a model-scoped 400 or a 404 lock).
+ * A bare id without a provider prefix has no lockout scope, so only the credential
+ * check applies.
+ */
+async function isFixedModelSelectable(
+  fixedModel: string,
+  usable: boolean | null,
+  deps: VisionBridgeRouterDeps
+): Promise<boolean> {
+  if (usable === false) return false;
+  const separator = fixedModel.indexOf("/");
+  if (separator < 1) return true;
+  return isModelUsableGivenLockouts(
+    fixedModel.slice(0, separator),
+    fixedModel.slice(separator + 1),
+    deps
+  );
+}
+
 async function cachedModelRemainsAvailable(
   fullModelId: string,
   deps: VisionBridgeRouterDeps
@@ -456,7 +477,7 @@ export async function getBestVisionModel(
     const usable = await checkCreds(fullConfig.fixedModel);
     // Only skip credential validation when the check is indeterminate (null).
     // A confirmed `false` means fall through to auto-selection.
-    if (usable !== false) {
+    if (await isFixedModelSelectable(fullConfig.fixedModel, usable, deps)) {
       return fullConfig.fixedModel;
     }
   }

tests/unit/vision-bridge-model-lockout-18268.test.ts

@@ -0,0 +1,65 @@
+import test from "node:test";
+import assert from "node:assert/strict";
+import { createProviderConnection } from "@/lib/db/providers";
+import { resetDbInstance } from "@/lib/db/core";
+import { callVisionModel, type VisionModelConfig } from "@/lib/guardrails/visionBridgeHelpers";
+import { isModelLocked } from "@omniroute/open-sse/services/accountFallback.ts";
+test.after(() => resetDbInstance());
+test("#18268: model-scoped 400 locks the Vision Bridge model and fallback continues", async () => {
+  const connection = await createProviderConnection({
+    provider: "openai",
+    authType: "apikey",
+    name: "vision-lockout",
+    apiKey: "sk-vision-lockout",
+  });
+  const attemptedModels: string[] = [];
+  const fetchImpl: typeof fetch = async (_input, init) => {
+    const body = JSON.parse(String(init?.body)) as { model: string };
+    attemptedModels.push(body.model);
+    if (body.model === "gpt-4o-mini")
+      return new Response(
+        JSON.stringify({
+          error: { code: "model_not_supported", message: "The requested model is not supported." },
+        }),
+        { status: 400, headers: { "x-omniroute-selected-connection-id": connection.id } }
+      );
+    return Response.json({
+      choices: [{ message: { content: "fallback description" } }],
+      content: [{ type: "text", text: "fallback description" }],
+    });
+  };
+  const deps = { hasUsableCredentials: async () => true, isModelLocked };
+  const config: VisionModelConfig = {
+    model: "openai/gpt-4o-mini",
+    prompt: "Describe",
+    timeoutMs: 30000,
+    maxImages: 1,
+    fetchImpl,
+  };
+  assert.equal(
+    await callVisionModel(
+      "data:image/png;base64,iVBORw0KGgo",
+      config,
+      undefined,
+      { maxFallbackAttempts: 2 },
+      deps
+    ),
+    "fallback description"
+  );
+  assert.equal(isModelLocked("openai", connection.id, "gpt-4o-mini"), true);
+  assert.equal(attemptedModels[0], "gpt-4o-mini");
+  assert.equal(attemptedModels.length, 2);
+  attemptedModels.length = 0;
+  assert.equal(
+    await callVisionModel(
+      "data:image/png;base64,iVBORw0KGgo",
+      config,
+      undefined,
+      { maxFallbackAttempts: 1 },
+      deps
+    ),
+    "fallback description"
+  );
+  assert.equal(attemptedModels.length, 1);
+  assert.notEqual(attemptedModels[0], "gpt-4o-mini");
+});