feat: add setting for provider/model-specific parameters

.gitignore

@@ -233,3 +233,4 @@ omniroute.md
 # mise configuration
 mise.toml
 _artifacts/
+.claude-flow/

CHANGELOG.md

@@ -8,6 +8,10 @@
 
 _Living section — bullets land here as PRs merge into `release/v3.8.47` (parallel-cycle model; cycle opened at the v3.8.46 release freeze). Finalized at the v3.8.47 release._
 
+### ✨ New Features
+
+- **Provider/model param filters**: config-driven parameter denylist/allowlist per provider/model with auto-learn from upstream 400s (#6649 — thanks @ThongAccount, closes #6625)
+
 ### 🐛 Bug Fixes
 
 - **fix(auth):** an API key restricted via `allowedModels`/`allowedCombos` could bypass that restriction entirely over the Codex Responses-over-WebSocket bridge ([#6564](https://github.com/diegosouzapw/OmniRoute/issues/6564)) — `prepare()` in `src/app/api/internal/codex-responses-ws/route.ts` authenticated the WS bridge's API key (`authenticate()`/`authorizeWebSocketHandshake()`) and honored `allowedConnections`, but never called `enforceApiKeyPolicy()`, the same model/combo policy gate the HTTP `/v1/responses` path enforces via `handleChat()` — so a key scoped to e.g. `combo/model-1.0` could still reach a direct Codex model like `gpt-5.5` through this transport, as long as an eligible Codex OAuth connection existed. The bridge's WS auth token arrives via query params (`api_key`/`token`/`access_token`), not a normal `Authorization` header, so a new `enforceCodexWsApiKeyPolicy()` builds an equivalent `Request` carrying an explicit `Authorization: Bearer <apiKey>` header and calls `enforceApiKeyPolicy()` against the CLIENT-requested model, before any Codex-specific model remapping or credential selection. Regression guard: `tests/unit/codex-ws-policy-enforcement-6564.test.ts` (a model-restricted key is rejected 403 before reaching credential selection; a combo-restricted key is rejected 403 requesting a disallowed combo; a key that DOES allow the requested model still proceeds past policy).

open-sse/config/providerFieldStrips.ts

@@ -22,6 +22,26 @@ export function findOffendingField(bodyText: string): string | null {
   return null;
 }
 
+/**
+ * Regex to extract an unsupported parameter name from upstream 400 error text.
+ * Matches:
+ *   - "Unsupported parameter(s): thinking"
+ *   - "Unsupported parameter: max_tokens"
+ *   - "Unsupported parameter 'reasoning_budget'"
+ */
+export const UNSUPPORTED_PARAM_RE =
+  /unsupported\s+parameter\w*(?:\s*\(s\))?[:\s]+["'`]?(\w+)["'`]?/i;
+
+/**
+ * Extract a single unsupported parameter name from a 400 error body,
+ * or null if the error does not match the known pattern.
+ */
+export function detectUnsupportedParam(bodyText: string): string | null {
+  if (typeof bodyText !== "string" || !bodyText) return null;
+  const match = UNSUPPORTED_PARAM_RE.exec(bodyText);
+  return match?.[1] ?? null;
+}
+
 /** Immutably drop request fields Groq rejects with a 400. */
 export function stripGroqUnsupportedFields<T extends Record<string, unknown>>(body: T): T {
   if (!body || typeof body !== "object") return body;

open-sse/executors/base.ts

@@ -4,7 +4,16 @@ import {
   normalizeAnthropicHeaderVariants,
 } from "../config/anthropicHeaders.ts";
 import { applyContextEditingToBody } from "../config/contextEditing.ts";
-import { findOffendingField, stripGroqUnsupportedFields } from "../config/providerFieldStrips.ts";
+import {
+  findOffendingField,
+  detectUnsupportedParam,
+  stripGroqUnsupportedFields,
+} from "../config/providerFieldStrips.ts";
+import {
+  getParamFilterConfig,
+  addParamToBlocklist,
+  isAutoLearnGloballyEnabled,
+} from "@/lib/db/paramFilters";
 import { applyFingerprint, isCliCompatEnabled } from "../config/cliFingerprints.ts";
 import { supportsClaudeMaxEffort, supportsXHighEffort } from "../config/providerModels.ts";
 import { getThinkingBudgetConfig, ThinkingMode } from "../services/thinkingBudget.ts";
@@ -1261,6 +1270,39 @@ export class BaseExecutor {
               `Upstream 400 rejected ${offending} on ${url} — retrying without it`
             );
             response = await fetchWithStartTimeout(url, { ...fetchOptions, body: retryBody });
+          } else {
+            // Auto-learn: detect "Unsupported parameter" errors and persist to DB
+            // when the provider config has autoLearn enabled (#6625).
+            const autoLearned = detectUnsupportedParam(errText);
+            if (
+              autoLearned &&
+              !strippedFields.has(autoLearned) &&
+              (transformedBody as Record<string, unknown>)[autoLearned] !== undefined
+            ) {
+              try {
+                const config = getParamFilterConfig(this.provider);
+                const shouldAutoLearn = isAutoLearnGloballyEnabled() || config?.autoLearn === true;
+                if (shouldAutoLearn) {
+                  strippedFields.add(autoLearned);
+                  addParamToBlocklist(this.provider, autoLearned, model);
+                  delete (transformedBody as Record<string, unknown>)[autoLearned];
+                  let retryBody = JSON.stringify(transformedBody);
+                  if (isClaudeCodeCompatible(this.provider) || this.provider === "claude") {
+                    retryBody = await signRequestBody(retryBody);
+                  }
+                  log?.info?.(
+                    "AUTO_LEARN",
+                    `Auto-learned "${autoLearned}" for provider ${this.provider} (model: ${model}) from 400 on ${url} — retrying`
+                  );
+                  response = await fetchWithStartTimeout(url, { ...fetchOptions, body: retryBody });
+                }
+              } catch (learnError) {
+                log?.warn?.(
+                  "AUTO_LEARN",
+                  `Failed to persist auto-learned param "${autoLearned}" for ${this.provider}: ${String(learnError)}`
+                );
+              }
+            }
           }
         }
 

open-sse/translator/paramSupport.ts

@@ -11,6 +11,8 @@
 // introduces new keys and never throws on null/undefined bodies — call sites
 // can chain it without extra guards.
 
+import { getParamFilterConfig, ModelParamFilter, ProviderParamFilter } from "@/lib/db/paramFilters";
+
 type StripRule = {
   provider?: string;
   match: RegExp | ((model: string) => boolean);
@@ -25,8 +27,7 @@ const STRIP_RULES: StripRule[] = [
   // GitHub Copilot Claude (except opus/sonnet 4.6): thinking + reasoning_effort rejected. #713
   {
     provider: "github",
-    match: (m: string) =>
-      /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
+    match: (m: string) => /claude/i.test(m) && !/claude.*(opus|sonnet).*4\.6/i.test(m),
     drop: ["thinking", "reasoning_effort"],
   },
   // NVIDIA NIM z-ai/glm-5.2: OpenAI-compatible wrapper rejects BOTH the `reasoning`
@@ -56,15 +57,106 @@ export function stripUnsupportedParams<T>(
 ): T {
   if (!model || !body || typeof body !== "object") return body;
   const rec = body as unknown as Record<string, unknown>;
+  // Snapshot the original body before any mutations so the allowlist can
+  // restore params that were stripped by hardcoded or config-driven denylist.
+  const snapshot = { ...rec };
+
+  // Phase 1: Hardcoded rules (unchanged)
   for (const rule of STRIP_RULES) {
     if (rule.provider && rule.provider !== provider) continue;
     if (!matches(rule, model)) continue;
     for (const key of rule.drop) {
       if (rec[key] !== undefined) delete rec[key];
     }
   }
+
+  // Phase 2: Config-driven rules from DB
+  applyConfigFilters(provider, model, rec, snapshot);
+
   return body;
 }
 
+/**
+ * Restore keys from `snapshot` into `body` for every key listed in `allow`,
+ * but only when the key was present in the original request. Shared by the
+ * provider-level and model-level allowlist passes below.
+ */
+function restoreAllowedKeys(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  allow: readonly string[]
+): void {
+  for (const key of allow) {
+    if (key in snapshot) {
+      body[key] = snapshot[key];
+    }
+  }
+}
+
+/**
+ * Apply the provider-level denylist, then restore the provider-level
+ * allowlist from `snapshot`. Runs BEFORE model-level operations so
+ * model-level settings can override provider-level ones.
+ */
+function applyProviderLevelFilters(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  config: ProviderParamFilter
+): void {
+  for (const key of config.block) {
+    delete body[key];
+  }
+  if (config.allow.length > 0) {
+    restoreAllowedKeys(body, snapshot, config.allow);
+  }
+}
+
+/**
+ * Apply the model-level denylist (overrides the provider-level allowlist),
+ * then restore the model-level allowlist from `snapshot` (final pass, most
+ * specific wins).
+ */
+function applyModelLevelFilters(
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>,
+  modelCfg: ModelParamFilter | undefined
+): void {
+  if (modelCfg?.block) {
+    for (const key of modelCfg.block) {
+      delete body[key];
+    }
+  }
+  if (modelCfg?.allow) {
+    restoreAllowedKeys(body, snapshot, modelCfg.allow);
+  }
+}
+
+/**
+ * Apply config-driven denylist + allowlist rules from the DB-backed
+ * ProviderParamFilter store. Order of operations:
+ *   1. Provider-level denylist
+ *   2. Model-level denylist
+ *   3. Provider-level allowlist (restores from snapshot)
+ *   4. Model-level allowlist (restores from snapshot)
+ *
+ * The allowlist only restores keys that were present in the original request
+ * (the snapshot). It never introduces new params the client didn't send.
+ */
+export function applyConfigFilters(
+  provider: string | null | undefined,
+  model: string | null | undefined,
+  body: Record<string, unknown>,
+  snapshot: Record<string, unknown>
+): void {
+  if (!provider || !body) return;
+  const config = getParamFilterConfig(provider);
+  if (!config) return;
+
+  applyProviderLevelFilters(body, snapshot, config);
+
+  const modelCfg = config.models?.[model ?? ""];
+  applyModelLevelFilters(body, snapshot, modelCfg);
+}
+
 // Exported for unit tests only — do not import from production code.
 export const __STRIP_RULES_FOR_TEST: ReadonlyArray<StripRule> = STRIP_RULES;

src/app/(dashboard)/dashboard/providers/[id]/ProviderDetailPageClient.tsx

@@ -39,7 +39,7 @@ import { useModelVisibilityHandlers } from "./hooks/useModelVisibilityHandlers";
 import { useModelCompatState } from "./hooks/useModelCompatState";
 import { useConnectionGate } from "./hooks/useConnectionGate";
 import { useProviderNodeActions } from "./hooks/useProviderNodeActions";
-import ProviderPlaygroundPanel from "./components/ProviderPlaygroundPanel";
+import ProviderExtraPanels from "./components/ProviderExtraPanels";
 import ProviderModelsSection from "./components/ProviderModelsSection";
 import CustomModelsSection from "./components/CustomModelsSection";
 import ConnectionsListPanel from "./components/ConnectionsListPanel";
@@ -696,8 +696,8 @@ export default function ProviderDetailPageClient() {
       {/* Search provider info */}
       {isSearchProvider && <SearchProviderCard providerId={providerId} t={t} />}
 
-      {/* Playground panel — rendered for providers that declare serviceKinds */}
-      <ProviderPlaygroundPanel providerId={providerId} />
+      {/* Playground + param filters — extracted to components/ProviderExtraPanels.tsx (#6649) */}
+      <ProviderExtraPanels providerId={providerId} />
 
       {/* Modals — Phase 1t.5: extracted to components/ProviderModalsPanel.tsx */}
       <ProviderModalsPanel