feat(settings): fetch the model list from any provider and flag models that cannot draw

The "Fetch models" button asks the provider for its models (OpenAI-style
/models, Anthropic, Google, Ollama, OpenRouter, Vercel Gateway, AIHubMix)
and shows them in a searchable picker. This replaces the route that only
worked for AIHubMix.

A snapshot of models.dev (MIT) says which models support tool calls.
Models without them get a "no tool calls" badge in the picker and a hint
in the model list, since drawing needs tool calls. Refresh the snapshot
with scripts/update-model-catalog.mjs.

app/api/aihubmix-models/route.ts

@@ -1,61 +0,0 @@
-import { NextResponse } from "next/server"
-import {
-    AIHUBMIX_MODELS_ENDPOINT,
-    extractAihubmixModelIds,
-} from "@/lib/aihubmix-models"
-import { SUGGESTED_MODELS } from "@/lib/types/model-config"
-
-const SUCCESS_CACHE_CONTROL =
-    "public, max-age=300, s-maxage=3600, stale-while-revalidate=86400"
-
-function fallbackResponse() {
-    return NextResponse.json(
-        {
-            models: SUGGESTED_MODELS.aihubmix || [],
-            source: "fallback",
-        },
-        {
-            headers: {
-                "Cache-Control": "no-store",
-            },
-        },
-    )
-}
-
-export async function GET() {
-    try {
-        const response = await fetch(AIHUBMIX_MODELS_ENDPOINT, {
-            next: { revalidate: 3600 },
-        })
-
-        if (!response.ok) {
-            console.warn(
-                `[aihubmix-models] Failed to fetch models: ${response.status}`,
-            )
-            return fallbackResponse()
-        }
-
-        const payload = await response.json()
-        const models = extractAihubmixModelIds(payload)
-
-        if (models.length === 0) {
-            console.warn("[aihubmix-models] Model list response was empty")
-            return fallbackResponse()
-        }
-
-        return NextResponse.json(
-            {
-                models,
-                source: "aihubmix",
-            },
-            {
-                headers: {
-                    "Cache-Control": SUCCESS_CACHE_CONTROL,
-                },
-            },
-        )
-    } catch (error) {
-        console.warn("[aihubmix-models] Failed to load models:", error)
-        return fallbackResponse()
-    }
-}

app/api/provider-models/route.ts

@@ -0,0 +1,62 @@
+import { NextResponse } from "next/server"
+import { checkAccessCode } from "@/lib/access-code"
+import { classifyLLMError } from "@/lib/llm-errors"
+import { canListModels, listProviderModels } from "@/lib/provider-models"
+import {
+    allowPrivateUrls,
+    isPrivateUrl,
+    redirectGuardedFetch,
+} from "@/lib/ssrf-protection"
+import type { ProviderName } from "@/lib/types/model-config"
+
+export const runtime = "nodejs"
+
+// Public lists need no key
+const NO_KEY_NEEDED = new Set<ProviderName>([
+    "ollama",
+    "openrouter",
+    "aihubmix",
+])
+
+/**
+ * The models a provider offers, for the "Fetch models" button in model
+ * settings. Answers { models: null } for providers that cannot list them,
+ * so the dialog keeps its suggested models.
+ */
+export async function POST(req: Request) {
+    // Sends requests to a URL the client chose, so require the access code
+    const accessError = checkAccessCode(req)
+    if (accessError) return accessError
+
+    const { provider, apiKey, baseUrl } = (await req.json()) as {
+        provider: ProviderName
+        apiKey?: string
+        baseUrl?: string
+    }
+    if (!canListModels(provider)) {
+        return NextResponse.json({ models: null })
+    }
+    // SECURITY: Block SSRF attacks via custom baseUrl
+    if (baseUrl && !allowPrivateUrls() && (await isPrivateUrl(baseUrl))) {
+        return NextResponse.json({ error: "Invalid base URL" }, { status: 400 })
+    }
+    if (!apiKey && !NO_KEY_NEEDED.has(provider)) {
+        return NextResponse.json(
+            { error: "API key is required" },
+            { status: 400 },
+        )
+    }
+
+    try {
+        const models = await listProviderModels(
+            provider,
+            { apiKey, baseUrl },
+            (baseUrl && redirectGuardedFetch()) || fetch,
+        )
+        return NextResponse.json({ models })
+    } catch (error) {
+        console.warn("[provider-models] Listing failed:", error)
+        const { code, message } = classifyLLMError(error)
+        return NextResponse.json({ code, error: message })
+    }
+}