codex - 💡(How to fix) Fix `/responses/compact` sends `service_tier` when provider-scoped API-key auth is used

What version of Codex CLI is running?

0.130

What subscription do you have?

api

Which model were you using?

gpt-5.5

What platform is your computer?

Linux 6.13.2-0_fbk7_0_gbc14455e13aa x86_64 x86_64

What terminal emulator and version are you using (if applicable)?

No response

Codex doctor report

What issue are you seeing?

Auto/manual compact can fail because Codex sends service_tier to /responses/compact:

Error running remote compact task: {"error":{"code":"invalid_request_error","message":"Pipeline execution failed: provider error (HTTP 400): Unknown parameter: 'service_tier'.","param":null,"type":"invalid_request_error"}}

This appears to happen when the active model provider uses provider-scoped command/bearer auth. The actual request auth is API-key-like, but compact decides whether to include service_tier using the session-level auth manager.

What steps can reproduce the bug?

1. Configure Codex to use a model provider with provider-scoped command/bearer auth (ModelProviderInfo.auth), so the provider request path uses AuthManager::external_bearer_only(...).
2. Configure a non-empty service_tier.
3. Start interactive Codex CLI/TUI.
4. Trigger manual or auto compact.
5. Observe that /responses/compact receives service_tier and can fail with Unknown parameter: 'service_tier'.

What is the expected behavior?

/responses/compact should not include service_tier when the actual resolved provider/request auth does not support it.

More generally, compact request compatibility should be based on the auth/provider setup used for that compact request, not only on the session-level auth manager.

Additional information

The current compact setup decides whether to pass service_tier here:

service_tier: if sess.services.auth_manager.auth_mode() == Some(AuthMode::ApiKey) {
    None
} else {
    turn_context.config.service_tier.clone()
},

That assumes sess.services.auth_manager.auth_mode() reflects the auth mode of the request sent to /responses/compact.

However, provider-scoped auth can replace the request auth later. In the configured provider path:

Some(config) => Some(AuthManager::external_bearer_only(config)),

and BearerTokenRefresher reports:

fn auth_mode(&self) -> AuthMode {
    AuthMode::ApiKey
}

So the actual compact request can be API-key/bearer-authenticated even when the session-level auth manager is not AuthMode::ApiKey.

Potential fixes:

1. Move the service_tier decision closer to ModelClient::compact_conversation_history, after current_client_setup(), and base it on the actual resolved provider/request auth.
2. As a safer short-term fix, omit service_tier from /responses/compact by default, or gate it until compact endpoint support is confirmed.