🐛 fix(web): preserve proxy route during model discovery

[ergs0204]

Summary

Prevent OpenAI-compatible model discovery from retrying without the selected credential route after a failure. This keeps saved per-entry proxies active and avoids masking the original error with a direct-connect response.

Scope

• Frontend panel
• Manager Server
• CPA panel mode
• Full Docker mode
• Native packages / release
• Docs / Wiki
• CI / build / tooling

Changes

• Keep the selected auth index, API key, provider headers, and entry headers on the model-discovery request.
• Remove the credentialless retry that could bypass the entry proxy.
• Ask users to save proxy-backed drafts before discovery so CPA can resolve the proxy through the saved auth index.
• Add regression coverage for routed failures, unsaved proxy entries, merged headers, and public endpoints.

User Impact

OpenAI-compatible providers with a configured per-entry proxy no longer fall back to a direct model-list request. Unsaved proxy-backed entries now show an actionable save-first error.

Compatibility / Runtime Notes

• CPA panel mode: Uses the saved auth index to preserve the per-entry proxy route.
• Manager Server mode: No server-side change.
• Full Docker / native packages: Frontend behavior is identical in Full Docker; native packaging is unchanged.

Data / Security Notes

No persisted data changes. Prevents an unintended direct upstream request that could expose the server exit IP when a proxy was configured.

Risk / Rollback

Risk level: Low

Rollback notes: Revert this commit to restore the previous credentialless fallback.

Verification

• Type check
• Lint
• Tests
• Build
• Manual UI check
• Docs/link check
• Not applicable, docs-only

Commands / evidence:

npm --workspace apps/web run test -- src/features/aiProviders/openAIModelDiscovery.test.ts
# 4 passed

npm run test
# 106 files, 972 tests passed

npm run type-check
npm run lint
npm run build
npm run check:demo-isolation

Screenshots / Recordings

N/A. The visible change is an error message shown only for unsaved proxy-backed entries.

Docs

• README / README_CN updated for user-visible capabilities
• Matching docs manual and navigation updated
• Demo fixtures, screenshots, and deep links reviewed
• Release notes needed
• Not needed — explanation included below

Docs decision:

This is a targeted bug fix with no new configuration or workflow.

Related

Fixes #362

[Copilot]

Pull request overview

This PR fixes OpenAI-compatible model discovery in the web app so it preserves the selected credential route (including per-entry proxies) instead of retrying “direct” after a failure, preventing proxy bypass and avoiding masking the original error.

Changes:

• Centralizes OpenAI model discovery logic into a shared helper and removes the credentialless fallback retry.
• Adds a save-first error message when a proxy-backed entry cannot be routed via a saved auth index.
• Adds regression tests covering routed failures, unsaved proxy entries, header merging, and public endpoints.

Reviewed changes

Copilot reviewed 7 out of 7 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
apps/web/src/features/aiProviders/AiProvidersOpenAIModelsPage.tsx	Switches model discovery to the new helper and removes the fallback retry path.
apps/web/src/features/aiProviders/openAIModelDiscovery.ts	New helper to discover models while preserving auth index, key, and headers (proxy route).
apps/web/src/features/aiProviders/openAIModelDiscovery.test.ts	New tests validating routed behavior, save-required proxy drafts, header merging, and public endpoints.
apps/web/src/i18n/locales/en.json	Adds new user-facing error message for unsaved proxy-backed entries.
apps/web/src/i18n/locales/ru.json	Adds new user-facing error message for unsaved proxy-backed entries.
apps/web/src/i18n/locales/zh-CN.json	Adds new user-facing error message for unsaved proxy-backed entries.
apps/web/src/i18n/locales/zh-TW.json	Adds new user-facing error message for unsaved proxy-backed entries.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: a257de5216

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[chatgpt-codex-connector]

Allow saved proxy entries without auth-index

When a proxy-backed OpenAI entry is created in the UI, the form/save path only includes an authIndex if one was already present; otherwise the saved config can be an api-key plus proxy-url entry. In environments where /openai-compatibility echoes that shape instead of injecting an auth-index, this guard keeps throwing the “save provider” error even after the user saves, so model discovery never issues a request for that provider. The save-first check needs to distinguish truly unsaved drafts from saved proxy entries or obtain a usable route before blocking.

Useful? React with 👍 / 👎.