fix(config): align codebase with immutable BackendSettings

Freeze BackendSettings and assemble named BackendConfig entries via the
model validator. Add AppConfig.mutate_backends for safe updates.

Update providers, semantic validation typing, tests, and CLI docs
(including per-output dynamic compression log level). Adjust Codex and
hybrid tests for hyphenated backend keys and model_validate construction.

Made-with: Cursor

Author: Mateusz

docs/user_guide/cli-parameters.md

@@ -239,6 +239,7 @@ See the [Dynamic Tool Output Compression Guide](features/dynamic-tool-output-com
 | `--dynamic-compression-disable-methods CSV` | N/A | Comma-separated compression methods to disable. |
 | `--dynamic-compression-disable-tools CSV` | N/A | Comma-separated tool names to bypass. |
 | `--dynamic-compression-disable-command-prefixes CSV` | N/A | Comma-separated command prefixes to bypass. |
+| `--dynamic-compression-per-output-evaluation-log-level LEVEL` | N/A | Per-output compression evaluation log level (`off`, `debug`, `info`). |
 
 ---
 

src/connectors/openai.py

@@ -323,6 +323,12 @@ def _raise_upstream_http_error(
             details=merged,
         )
 
+    if status_code == 401 or status_code == 403:
+        raise AuthenticationError(
+            message=message,
+            details=merged,
+        )
+
     if 400 <= status_code < 500:
         raise InvalidRequestError(
             message=message,
@@ -2107,9 +2113,13 @@ async def responses(
             if isinstance(use_websocket_raw, bool)
             else self._use_websocket
         )
-        connector_context = kwargs.get("context")
-        if not isinstance(connector_context, ConnectorRequestContext):
-            connector_context = None
+        # Start from request.context (canonical path), then let options override
+        connector_context: ConnectorRequestContext | None = None
+        if isinstance(request.context, ConnectorRequestContext):
+            connector_context = request.context
+        options_context = kwargs.get("context")
+        if isinstance(options_context, ConnectorRequestContext):
+            connector_context = options_context
         if use_websocket:
             return await self._handle_websocket_response(
                 payload,

src/connectors/openai_codex/settings.py

@@ -105,6 +105,8 @@ def load(self, app_config: AppConfig) -> CodexConnectorSettings:  # noqa: C901
         }
 
         backend_config = getattr(app_config.backends, "openai_codex", None)
+        if backend_config is None and hasattr(app_config.backends, "lookup"):
+            backend_config = app_config.backends.lookup("openai-codex")
         backend_extra: dict[str, Any] = {}
         if backend_config and hasattr(backend_config, "extra"):
             try:
@@ -434,9 +436,15 @@ def load(self, app_config: AppConfig) -> CodexConnectorSettings:  # noqa: C901
                     if isinstance(parsed, list):
                         accounts = to_string_list(parsed)
                     else:
-                        accounts = [part.strip() for part in normalized.split(",") if part.strip()]
+                        accounts = [
+                            part.strip()
+                            for part in normalized.split(",")
+                            if part.strip()
+                        ]
                 else:
-                    accounts = [part.strip() for part in normalized.split(",") if part.strip()]
+                    accounts = [
+                        part.strip() for part in normalized.split(",") if part.strip()
+                    ]
         elif isinstance(raw_accounts_source, list):
             accounts = to_string_list(raw_accounts_source)
         elif raw_accounts_source == "all":
@@ -459,7 +467,9 @@ def load(self, app_config: AppConfig) -> CodexConnectorSettings:  # noqa: C901
             os.getenv("OPENAI_CODEX_MANAGED_OAUTH_REFRESH_BUFFER_SECONDS")
         )
         if refresh_buffer is None:
-            refresh_buffer = coerce_positive_int(managed_cfg.get("refresh_buffer_seconds"))
+            refresh_buffer = coerce_positive_int(
+                managed_cfg.get("refresh_buffer_seconds")
+            )
         if refresh_buffer is None:
             refresh_buffer = settings["managed_oauth"]["refresh_buffer_seconds"]
 
@@ -484,7 +494,9 @@ def load(self, app_config: AppConfig) -> CodexConnectorSettings:  # noqa: C901
             affinity_max = settings["managed_oauth"]["session_affinity_max_entries"]
 
         allow_legacy_fallback = managed_cfg.get("allow_legacy_fallback")
-        env_allow_fallback = os.getenv("OPENAI_CODEX_MANAGED_OAUTH_ALLOW_LEGACY_FALLBACK")
+        env_allow_fallback = os.getenv(
+            "OPENAI_CODEX_MANAGED_OAUTH_ALLOW_LEGACY_FALLBACK"
+        )
         if env_allow_fallback is not None:
             allow_legacy_fallback = env_allow_fallback.strip().lower() in truthy
         elif allow_legacy_fallback is None:

src/core/app/controllers/responses_controller.py

@@ -16,7 +16,9 @@
 from fastapi.responses import StreamingResponse
 from pydantic import ValidationError
 
-from src.core.app.controllers.responses_stream_coercion import coerce_stream_chunk_payload
+from src.core.app.controllers.responses_stream_coercion import (
+    coerce_stream_chunk_payload,
+)
 from src.core.common.exceptions import (
     InitializationError,
     LLMProxyError,

src/core/app/test_builder.py

@@ -173,9 +173,7 @@ async def build_test_app_async(config: AppConfig | None = None) -> FastAPI:
             and not getattr(config.auth, "disable_auth", False)
             and not (list(getattr(config.auth, "api_keys", []) or []))
         ):
-            new_auth = config.auth.model_copy(
-                update={"api_keys": ["test-proxy-key"]}
-            )
+            new_auth = config.auth.model_copy(update={"api_keys": ["test-proxy-key"]})
             config = config.model_copy(update={"auth": new_auth})
     except (AttributeError, TypeError, ValidationError):
         logger.warning(
@@ -335,16 +333,16 @@ def create_test_config() -> AppConfig:
     default_backend = os.environ.get("LLM_BACKEND", "openai")
 
     # Set up backend config based on the default backend
-    backend_settings = BackendSettings(default_backend=default_backend)
-
-    # Always include openai as a fallback
-    backend_settings.__dict__["openai"] = BackendConfig(api_key="test_key")
-
-    # Add the default backend if it's not openai
+    extra_backends: dict[str, BackendConfig] = {
+        "openai": BackendConfig(api_key="test_key"),
+    }
     if default_backend != "openai":
-        backend_settings.__dict__[default_backend] = BackendConfig(
+        extra_backends[default_backend] = BackendConfig(
             api_key=f"test_key_{default_backend}"
         )
+    backend_payload: dict[str, Any] = {"default_backend": default_backend}
+    backend_payload.update(extra_backends)
+    backend_settings = BackendSettings.model_validate(backend_payload)
 
     # Get command prefix from environment if set
     command_prefix = os.environ.get("COMMAND_PREFIX", "!/")

src/core/cli.py

@@ -14,7 +14,7 @@
 import os
 import sys
 from collections.abc import Callable
-from typing import Literal, overload
+from typing import Any, Literal, overload
 
 from fastapi import FastAPI
 
@@ -144,9 +144,7 @@ def apply_cli_args(
     return final_cfg
 
 
-def _emit_legacy_compression_deprecation_warnings(
-    *, config: AppConfig
-) -> None:
+def _emit_legacy_compression_deprecation_warnings(*, config: AppConfig) -> None:
     deprecated_env_controls = {
         "GEMINI_TOOL_OUTPUT_TRUNCATE_CHARS": (
             "dynamic_compression.methods.compact_acknowledgement + "
@@ -181,7 +179,9 @@ def _emit_legacy_compression_deprecation_warnings(
     )
     configured_legacy_extras: list[str] = []
     backends = getattr(config, "backends", None)
-    backend_items = getattr(backends, "__dict__", {})
+    backend_items: dict[str, Any] = {}
+    if backends is not None and hasattr(backends, "get_named_backend_configs"):
+        backend_items = backends.get_named_backend_configs()
     if isinstance(backend_items, dict):
         for backend_name, backend_config in backend_items.items():
             if backend_name.startswith("_") or backend_name == "default_backend":

src/core/config/app_config.py

@@ -204,6 +204,24 @@ def set(self, key: str, value: Any) -> None:
     def get_gcp_project_id(self) -> str | None:
         return self.gcp_project_id
 
+    def mutate_backends(
+        self,
+        updates: Mapping[str, Any] | None = None,
+        **kwargs: Any,
+    ) -> None:
+        """Merge *updates* into ``backends`` and assign the new aggregate.
+
+        ``BackendSettings`` is immutable; tests and migration helpers must not
+        assign attributes on ``config.backends`` directly. Pass a mapping for
+        hyphenated backend keys (for example ``{"openai-codex": BackendConfig()}``)
+        and/or keyword arguments for declared fields such as ``default_backend``.
+        """
+        merged: dict[str, Any] = {}
+        if updates is not None:
+            merged.update(dict(updates))
+        merged.update(kwargs)
+        self.backends = self.backends.model_copy(update=merged)
+
 
 def load_config(
     config_path: str | Path | None = None,