API request fails with "name must be at most 64 characters, got 66" via OpenRouter due to long plugin IDs

What version of the Codex App are you using (From “About Codex” dialog)?

Version 26.901.41600

What subscription do you have?

PRO

What platform is your computer?

Microsoft Windows NT 10.0.19045.0 x64

What issue are you seeing?

Description

When using Codex CLI / Desktop app with OpenRouter, requests fail with a HTTP 400 error indicating that a tool name exceeds the 64-character limit.

This happens because Codex dynamically injects <recommended_plugins> into the context and registers them as tools. The generated tool names combine an action prefix (like install_ or connect_) with a 58-character plugin ID (e.g., app-68de829bf7648191acd70a907364c67c@openai-curated-remote). With the @ replaced by an underscore, this results in a tool name that is exactly 66 characters long, breaking the strict OpenAI specification for function calling.

Interestingly, this issue is model/provider-dependent:

• Fails on: muse-1.3-spark (via OpenRouter) – strictly enforces the 64-character limit per standard API specs.
• Works on: glm-5.3 – likely because the provider for this specific model silently truncates the name, relaxes the schema validation, or handles it gracefully under the hood.

What steps can reproduce the bug?

Steps to Reproduce

1. Run Codex Desktop in a workspace.
2. Ensure there are uninstalled plugins that trigger the <recommended_plugins> context injection.
3. Configure the model provider to OpenRouter and select a strict model like muse-1.3-spark.
4. Submit any prompt.
5. The request immediately fails before the model starts streaming.

Error Message

open router `name` must be at most 64 characters, got 66.

Root Cause Analysis

In the injected system prompt, there is a section listing plugins:

<recommended_plugins>
Here is a list of plugins that are available but not installed.
...
- Spotify (app-68de829bf7648191acd70a907364c67c@openai-curated-remote)
...
</recommended_plugins>

The raw string app-68de829bf7648191acd70a907364c67c@openai-curated-remote is exactly 58 characters.
When Codex maps this to a tool/function name (e.g., prepending an 8-character prefix like install_ and replacing @ with _), the resulting string evaluates to install_app-68de829bf7648191acd70a907364c67c_openai-curated-remote, which is 66 characters.

The OpenAI specification strictly limits function names to a maximum of 64 characters: ^[a-zA-Z0-9_-]{1,64}$.

What is the expected behavior?

Expected Behavior

Codex should either:

1. Truncate or hash the plugin IDs when converting them to tool names to ensure they never exceed 64 characters.
2. Sanitize and validate all dynamically generated tool names before passing them to the client API layer.

Additional information

Environment

• Platform: Codex Desktop
• OS: Windows
• API Provider: OpenRouter
• Failing Model: muse-1.3-spark
• Working Model: glm-5.3 (likely ignores/bypasses length constraints)

This appears to be part of a broader architectural oversight regarding the 64-character limit, as seen in local skill validation issues #24950 and #25042. However, this specific bug breaks external API integrations via OpenRouter.

No source file or test is named. Start by tracing the recommended_plugins context injection and the code that converts plugin IDs into tool names; reproduce the OpenRouter failure with the shown 66-character name. Done means dynamically generated names comply with the 64-character limit and a regression test covers a long plugin ID.