fix(providers): apply the review of PR #988

Five reviewers (Fable 5.1, Opus 5.5, Sonnet 5.5, Codex GPT-6 Astra, Codex
GPT-6.1 Sol) found no behavior or security regression; this commit applies
what they asked for.

Settings dialog: the automatic model list fetch only fills the list, which
waits behind 'Browse models'; it no longer opens the picker (the modal picker
took the focus from whatever the user was typing) and shows no error of its
own. One list request per provider at a time, so a click during the automatic
fetch sends nothing twice; the baseline that detects freshly entered
credentials is taken on every visit of a provider page; SGLang's prefilled
local example URL triggers no fetch. Entries saved with Azure's old
placeholder URL still count as having no URL. The base URL field of Azure and
of the custom preset is labelled required (new dictionary key baseUrlRequired).

Smaller code: the PROVIDER_INFO alias is gone (three files and the tests
import PROVIDERS), as are three logo values no code read, two unused type
re-exports, three unused exports and SINGLE_SYSTEM_PROVIDERS (the chat route
reads the record). Renamed for clarity: REQUIRED_KEY_VARS, requiredKeyEnv,
configuredUrl, LocalizedText. Seven stale comments rewritten; the custom
preset's note shortened.

Tests: the matrix gains six override shapes (a Vertex key alone, AWS keys with
a session token, headers with a URL, a trusted URL with a key, a key with a
server model's URL variable, '/' alone), 5843 rows; the new rows were
regenerated on the pre-refactor code and match it. The matrix and the server
credential tests clear every variable they read; the admin variable table
covers every provider; a test that derived its expectation from the function
under test is gone; the singleSystem, listNeedsNoKey, sdkKnowsEndpoint and
auto-detection sets are spelled out.

Docs: the READMEs say 25 providers and name the OpenAI-compatible preset; the
AI_PROVIDER lists are complete; the Azure example URL has its /openai suffix;
'Adding a Provider' names the tests to update.

README.md

@@ -38,7 +38,7 @@ Available as a web app, a desktop app for Windows, macOS and Linux, and an MCP s
 
 **Use**
 
--   24 model providers; enter your own API key in the browser and it stays on your machine
+-   25 model providers, including an OpenAI-compatible preset for any other URL; enter your own API key in the browser and it stays on your machine
 -   Models that reason show their thinking
 -   Dark mode; the interface is available in English, Simplified Chinese, Traditional Chinese and Japanese
 
@@ -151,7 +151,7 @@ Open [http://localhost:6002](http://localhost:6002).
 
 ### Models and providers
 
-24 providers are supported: AWS Bedrock (default), OpenAI, Anthropic, Google AI, Google Vertex AI, Azure OpenAI, Ollama, OpenRouter, AIHubMix, DeepSeek, SiliconFlow, SGLang, Vercel AI Gateway, Tencent EdgeOne, ByteDance Doubao, ModelScope, Zhipu GLM, Qwen, Qiniu, Kimi, MiniMax, Novita, Xiaomi MiMo and Atlas Cloud. The environment variables and notes for each are in the [provider configuration guide](./docs/en/ai-providers.md).
+25 providers are supported: AWS Bedrock (default), OpenAI, Anthropic, Google AI, Google Vertex AI, Azure OpenAI, Ollama, OpenRouter, AIHubMix, DeepSeek, SiliconFlow, SGLang, Vercel AI Gateway, Tencent EdgeOne, ByteDance Doubao, ModelScope, Zhipu GLM, Qwen, Qiniu, Kimi, MiniMax, Novita, Xiaomi MiMo, Atlas Cloud, and an OpenAI-compatible preset for any other URL (vLLM, LM Studio, a gateway). The environment variables and notes for each are in the [provider configuration guide](./docs/en/ai-providers.md).
 
 **Which model**: the task is to produce long text in a strict format (draw.io XML), so pick a capable model; small models tend to produce broken diagrams.
 

app/[lang]/admin/models-section.tsx

@@ -70,7 +70,7 @@ function ProviderDetail({
     const info = PROVIDERS[provider.provider]
     // Only providers that cannot list their models have a list here; for
     // the others the admin types the model id
-    const suggestions = (PROVIDERS[provider.provider].models ?? []).filter(
+    const suggestions = (info.models ?? []).filter(
         (m) => !provider.models.includes(m),
     )
 

app/api/chat/route.ts

@@ -16,7 +16,6 @@ import {
     edgeOneEndpoint,
     getAIModel,
     getServerProvider,
-    SINGLE_SYSTEM_PROVIDERS,
     supportsPromptCaching,
     usesServerCredentials,
     usesServerEndpoint,
@@ -433,7 +432,7 @@ ${userInputText}
                 process.env[serverModelConfig.baseUrlEnv])
         )
     const isSingleSystemProvider =
-        SINGLE_SYSTEM_PROVIDERS.has(resolvedProvider) || isCustomOpenAIEndpoint
+        !!PROVIDERS[resolvedProvider].singleSystem || isCustomOpenAIEndpoint
 
     const selectionContext = formatSelectionContext(body.selectedCells)
     // The model reads the diagram in the compact notation it writes

components/model-config-dialog.tsx

@@ -55,7 +55,7 @@ import { getApiEndpoint } from "@/lib/base-path"
 import { formatMessage } from "@/lib/i18n/utils"
 import type { ListedModel } from "@/lib/provider-models"
 import { hasCredentials } from "@/lib/provider-setup"
-import { PROVIDERS } from "@/lib/providers"
+import { PROVIDERS, publicDefaultUrl } from "@/lib/providers"
 import { STORAGE_KEYS } from "@/lib/storage"
 import type {
     ModelConfig,
@@ -306,13 +306,30 @@ export function ModelConfigDialog({
         model_not_found: t.modelNotFound,
     })
 
-    const handleFetchModels = async () => {
+    // Requests in flight, by provider id: a second request for the same
+    // provider (the button clicked while the automatic fetch runs, or the
+    // reverse) is not sent
+    const inFlight = useRef(new Set<string>())
+    // The credentials each provider's automatic fetch ran with, or was
+    // overtaken by a click with: one automatic fetch per set of credentials
+    const autoFetched = useRef<Record<string, string>>({})
+
+    /**
+     * Fetch the shown provider's model list. A click opens the picker with
+     * the result and shows what went wrong; the automatic fetch after
+     * credentials were entered (auto) only fills the list, so it never
+     * takes the focus or flashes an error while the user is still typing.
+     */
+    const handleFetchModels = async (auto = false) => {
         if (!selectedProvider) return
         const providerId = selectedProvider.id
+        if (inFlight.current.has(providerId)) return
         const askedWith = credentialsOf(providerId)
+        autoFetched.current[providerId] = askedWith
         const hints = errorHints(selectedProvider)
+        inFlight.current.add(providerId)
         setFetchingFor((current) => [...current, providerId])
-        setFetchModelsError("")
+        if (!auto) setFetchModelsError("")
         try {
             const response = await fetch(
                 getApiEndpoint("/api/provider-models"),
@@ -339,11 +356,11 @@ export function ModelConfigDialog({
                     ...current,
                     [providerId]: { askedWith, models: data.models },
                 }))
-                if (!stillShown) return
+                if (!stillShown || auto) return
                 if (data.models.length > 0) setModelPickerOpen(true)
                 else setFetchModelsError(t.noModelsReturned)
             } else {
-                if (!stillShown) return
+                if (!stillShown || auto) return
                 setFetchModelsError(
                     [hints[data.code], data.error].filter(Boolean).join(" ") ||
                         formatMessage(t.requestFailed, {
@@ -353,12 +370,14 @@ export function ModelConfigDialog({
             }
         } catch {
             if (
+                !auto &&
                 selectedProviderIdRef.current === providerId &&
                 credentialsOf(providerId) === askedWith
             ) {
                 setFetchModelsError(dict.errors.networkError)
             }
         } finally {
+            inFlight.current.delete(providerId)
             setFetchingFor((current) =>
                 current.filter((id) => id !== providerId),
             )
@@ -406,23 +425,33 @@ export function ModelConfigDialog({
         .slice(0, 4)
 
     // A provider that can list its models gets its list fetched by itself,
-    // once, for credentials entered on its page while it has no model yet:
-    // the user picks from the list instead of a hand-written one. Credentials
-    // a provider already had when its page opened fetch nothing (the button
-    // does), nor does a provider with models.
+    // once, for credentials entered on its page while it has no model yet,
+    // so "Browse models" offers the provider's own list instead of a
+    // hand-written one. Credentials a provider already had when its page
+    // opened fetch nothing (the button does), nor does a provider with
+    // models, nor a local example URL still in the field (SGLang's).
     const shownWith = useRef<{ id: string; credentials: string } | null>(null)
-    const autoFetched = useRef<Record<string, string>>({})
     useEffect(() => {
-        if (!open || !selectedProvider) return
+        if (!open || !selectedProvider) {
+            // The baseline belongs to one visit of one provider's page
+            shownWith.current = null
+            return
+        }
         const id = selectedProvider.id
         const now = credentialsOf(id)
         if (shownWith.current?.id !== id) {
             shownWith.current = { id, credentials: now }
         }
+        const def = PROVIDERS[selectedProvider.provider]
+        const localExample =
+            !!selectedProvider.baseUrl &&
+            selectedProvider.baseUrl === def.defaultBaseUrl &&
+            !publicDefaultUrl(selectedProvider.provider)
         if (
-            !PROVIDERS[selectedProvider.provider].modelList ||
+            !def.modelList ||
             selectedProvider.models.length > 0 ||
             !hasCredentials(selectedProvider) ||
+            localExample ||
             now === shownWith.current.credentials ||
             autoFetched.current[id] === now
         ) {
@@ -430,8 +459,8 @@ export function ModelConfigDialog({
         }
         // Once the typing or pasting pauses
         const timer = setTimeout(() => {
-            autoFetched.current[id] = now
-            void handleFetchModels()
+            if (autoFetched.current[id] === now) return
+            void handleFetchModels(true)
         }, 600)
         return () => clearTimeout(timer)
     }, [open, selectedProvider])
@@ -1064,7 +1093,7 @@ export function ModelConfigDialog({
                                 def.modelList && (
                                     <button
                                         type="button"
-                                        onClick={handleFetchModels}
+                                        onClick={() => handleFetchModels()}
                                         disabled={fetchingFor.includes(
                                             provider.id,
                                         )}

components/provider-credentials-fields.tsx

@@ -92,9 +92,13 @@ export function ProviderCredentialsFields({
     const dict = useDictionary()
     const locale = useLocale()
     const info = PROVIDERS[provider]
-    const baseUrlLabel = formatMessage(dict.modelConfig.baseUrlWithExample, {
-        example: info.defaultBaseUrl || "https://api.example.com/v1",
-    })
+    // A key-only provider without a default URL (Azure, custom) needs one
+    const baseUrlLabel =
+        info.credential === "apiKey" && !info.defaultBaseUrl
+            ? dict.modelConfig.baseUrlRequired
+            : formatMessage(dict.modelConfig.baseUrlWithExample, {
+                  example: info.defaultBaseUrl || "https://api.example.com/v1",
+              })
     const requestUrl = baseUrl ? chatRequestUrl(provider, baseUrl) : null
     // Open when it holds something the user set, or for a provider whose
     // base URL usually needs changing or comes with a hint

components/settings/providers-list.tsx

@@ -16,11 +16,11 @@ import { ScrollArea } from "@/components/ui/scroll-area"
 import { useDictionary } from "@/hooks/use-dictionary"
 import { formatMessage } from "@/lib/i18n/utils"
 import { POPULAR_PROVIDERS, providerStatus } from "@/lib/provider-setup"
-import {
-    type FlattenedModel,
-    PROVIDER_INFO,
-    type ProviderConfig,
-    type ProviderName,
+import { PROVIDERS } from "@/lib/providers"
+import type {
+    FlattenedModel,
+    ProviderConfig,
+    ProviderName,
 } from "@/lib/types/model-config"
 import { cn } from "@/lib/utils"
 
@@ -169,7 +169,7 @@ export function ProvidersList({
                                                 />
                                             </span>
                                             <span className="truncate">
-                                                {PROVIDER_INFO[provider].label}
+                                                {PROVIDERS[provider].label}
                                             </span>
                                         </button>
                                     ))}
@@ -180,8 +180,7 @@ export function ProvidersList({
                                     className="flex items-center gap-1 text-[13px] font-medium hover:underline"
                                 >
                                     {formatMessage(t.viewAllProviders, {
-                                        count: Object.keys(PROVIDER_INFO)
-                                            .length,
+                                        count: Object.keys(PROVIDERS).length,
                                     })}
                                     <ChevronRight className="size-3.5" />
                                 </button>
@@ -225,7 +224,7 @@ export function ProvidersList({
                                                 <span className="flex items-center gap-2 text-[13px] font-medium">
                                                     <span className="truncate">
                                                         {p.name ||
-                                                            PROVIDER_INFO[
+                                                            PROVIDERS[
                                                                 p.provider
                                                             ].label}
                                                     </span>

docs/cn/README_CN.md

@@ -151,7 +151,7 @@ npm run dev
 
 ### 模型与服务商
 
-支持 AWS Bedrock（默认）、OpenAI、Anthropic、Google AI、Google Vertex AI、Azure OpenAI、Ollama、OpenRouter、AIHubMix、DeepSeek、SiliconFlow、SGLang、Vercel AI Gateway、腾讯云 EdgeOne、字节跳动豆包、ModelScope、智谱 GLM、通义千问、七牛云、Kimi、MiniMax、Novita、小米 MiMo、Atlas Cloud 共 24 家。各家的环境变量和注意事项见[服务商配置指南](./ai-providers.md)。
+支持 AWS Bedrock（默认）、OpenAI、Anthropic、Google AI、Google Vertex AI、Azure OpenAI、Ollama、OpenRouter、AIHubMix、DeepSeek、SiliconFlow、SGLang、Vercel AI Gateway、腾讯云 EdgeOne、字节跳动豆包、ModelScope、智谱 GLM、通义千问、七牛云、Kimi、MiniMax、Novita、小米 MiMo、Atlas Cloud，以及一个可填任意地址的 OpenAI 兼容预设（vLLM、LM Studio、网关），共 25 家。各家的环境变量和注意事项见[服务商配置指南](./ai-providers.md)。
 
 **选哪个模型**：这项任务要生成格式严格的长文本（draw.io XML），请选能力较强的模型，小模型容易画出错误的图。
 

docs/cn/ai-providers.md

@@ -132,7 +132,7 @@ AI_MODEL=your-deployment-name
 
 ```bash
 AZURE_API_KEY=your_api_key
-AZURE_BASE_URL=https://your-resource.openai.azure.com  # AZURE_RESOURCE_NAME 的替代方案
+AZURE_BASE_URL=https://your-resource.openai.azure.com/openai  # AZURE_RESOURCE_NAME 的替代方案
 AI_MODEL=your-deployment-name
 ```
 
@@ -325,7 +325,7 @@ MIMO_BASE_URL=https://token-plan-cn.xiaomimimo.com/v1
 
 ### 任何 OpenAI 兼容接口（custom）
 
-上面没有列出的服务（vLLM、LM Studio、LiteLLM、API 网关），在设置里选择 **OpenAI-compatible**，填入它的地址和 key；服务端不校验 key 时填任意非空内容即可。多条 system 消息会合并成一条（开源模型的对话模板通常要求这样），`<think>` 里的推理内容会从回复里分离出来。
+上面没有列出的服务（vLLM、LM Studio、LiteLLM、API 网关），在设置里选择 **OpenAI-compatible**，填入它的地址和 Key；服务端不校验 key 时填任意非空内容即可。多条 system 消息会合并成一条（开源模型的对话模板通常要求这样），`<think>` 里的推理内容会从回复里分离出来。
 
 ```bash
 CUSTOM_API_KEY=your_api_key
@@ -342,7 +342,7 @@ AI_MODEL=your_model_id
 如果您配置了**多个** API 密钥，则必须显式设置 `AI_PROVIDER`：
 
 ```bash
-AI_PROVIDER=google  # 或：openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # 或：openai, anthropic, google, vertexai, azure, bedrock, ollama, openrouter, aihubmix, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita, mimo, atlascloud, custom
 ```
 
 ## 服务端多模型配置
@@ -466,3 +466,4 @@ TEMPERATURE=0  # 输出更具确定性（推荐用于图表）
     需要在地址输入框下方显示提示，或在选择器里显示说明的服务商，在记录里加 `baseUrlHint` 或 `note` 对象，四种界面语言（`en`、`zh`、`ja`、`zh-Hant`）都要写。不能在线列出模型的服务商不写 `modelList`，改写一个短的 `models` 列表。
 2. 在 `env.example` 里加上 `ACME_API_KEY` 和 `ACME_BASE_URL`（有一个单元测试检查每条记录的变量名都出现在里面）。
 3. 在 `docs/en`、`docs/cn`、`docs/ja` 的本文档里各加一节说明。
+4. 把它加进 `tests/unit/provider-matrix.test.ts` 开头的两个清单（`MATRIX_PROVIDERS` 和 `MATRIX_MODEL_IDS`），用 `npx vitest run tests/unit/provider-matrix.test.ts -u` 重新生成行为快照；新增的行都属于这家服务商，已有的行不能变。`tests/unit/providers.test.ts` 写明了选择器的分组和会改变服务端行为的服务商集合（自动检测、只接受一条 system 消息），也要加进去。三份 README 里的服务商数量和本文档的 `AI_PROVIDER` 可选值清单同样要改。

docs/en/ai-providers.md

@@ -147,7 +147,7 @@ Or use a custom endpoint instead of resource name:
 
 ```bash
 AZURE_API_KEY=your_api_key
-AZURE_BASE_URL=https://your-resource.openai.azure.com  # Alternative to AZURE_RESOURCE_NAME
+AZURE_BASE_URL=https://your-resource.openai.azure.com/openai  # Alternative to AZURE_RESOURCE_NAME
 AI_MODEL=your-deployment-name
 ```
 
@@ -357,7 +357,7 @@ If you only configure **one** provider's API key, the system will automatically
 If you configure **multiple** API keys, you must explicitly set `AI_PROVIDER`:
 
 ```bash
-AI_PROVIDER=google  # or: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # or: openai, anthropic, google, vertexai, azure, bedrock, ollama, openrouter, aihubmix, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita, mimo, atlascloud, custom
 ```
 
 ## Server-Side Multi-Model Configuration
@@ -481,3 +481,4 @@ Every fact about a provider lives in one record in `lib/providers.ts`: which AI
     A provider that needs a hint under its base URL field, or a note in the picker, gets a `baseUrlHint` or `note` object with all four UI languages (`en`, `zh`, `ja`, `zh-Hant`). Providers that cannot list their models online keep a short `models` list instead of `modelList`.
 2. Add `ACME_API_KEY` and `ACME_BASE_URL` to `env.example` (a unit test checks that every record's variables appear there).
 3. Add a section for it to this document in `docs/en`, `docs/cn` and `docs/ja`.
+4. Add it to the two lists at the top of `tests/unit/provider-matrix.test.ts` (`MATRIX_PROVIDERS` and `MATRIX_MODEL_IDS`) and regenerate the behavior snapshot with `npx vitest run tests/unit/provider-matrix.test.ts -u`; the new rows are the provider's, the existing rows must not change. `tests/unit/providers.test.ts` spells out the picker's groups and the provider sets that change what the server does (auto-detection, single system message), so add it there too. The provider count in the three READMEs and the `AI_PROVIDER` list in this document change as well.

docs/ja/README_JA.md

@@ -151,7 +151,7 @@ npm run dev
 
 ### モデルとプロバイダー
 
-AWS Bedrock（既定）、OpenAI、Anthropic、Google AI、Google Vertex AI、Azure OpenAI、Ollama、OpenRouter、AIHubMix、DeepSeek、SiliconFlow、SGLang、Vercel AI Gateway、Tencent EdgeOne、ByteDance Doubao、ModelScope、Zhipu GLM、Qwen、Qiniu、Kimi、MiniMax、Novita、Xiaomi MiMo、Atlas Cloud の 24 プロバイダーに対応しています。各プロバイダーの環境変数と注意点は[プロバイダー設定ガイド](./ai-providers.md)にあります。
+AWS Bedrock（既定）、OpenAI、Anthropic、Google AI、Google Vertex AI、Azure OpenAI、Ollama、OpenRouter、AIHubMix、DeepSeek、SiliconFlow、SGLang、Vercel AI Gateway、Tencent EdgeOne、ByteDance Doubao、ModelScope、Zhipu GLM、Qwen、Qiniu、Kimi、MiniMax、Novita、Xiaomi MiMo、Atlas Cloud、および任意の URL を使える OpenAI 互換プリセット（vLLM、LM Studio、ゲートウェイ）の 25 プロバイダーに対応しています。各プロバイダーの環境変数と注意点は[プロバイダー設定ガイド](./ai-providers.md)にあります。
 
 **どのモデルを選ぶか**：厳密な形式の長いテキスト（draw.io の XML）を生成するタスクなので、能力の高いモデルを選んでください。小さなモデルは壊れた図を出しがちです。
 

docs/ja/ai-providers.md

@@ -132,7 +132,7 @@ AI_MODEL=your-deployment-name
 
 ```bash
 AZURE_API_KEY=your_api_key
-AZURE_BASE_URL=https://your-resource.openai.azure.com  # AZURE_RESOURCE_NAME の代替
+AZURE_BASE_URL=https://your-resource.openai.azure.com/openai  # AZURE_RESOURCE_NAME の代替
 AI_MODEL=your-deployment-name
 ```
 
@@ -342,7 +342,7 @@ AI_MODEL=your_model_id
 **複数**の API キーを設定する場合は、`AI_PROVIDER` を明示的に設定する必要があります:
 
 ```bash
-AI_PROVIDER=google  # または: openai, anthropic, aihubmix, deepseek, siliconflow, doubao, azure, bedrock, openrouter, ollama, gateway, sglang, modelscope, minimax, glm, qwen, kimi, qiniu, mimo
+AI_PROVIDER=google  # または: openai, anthropic, google, vertexai, azure, bedrock, ollama, openrouter, aihubmix, deepseek, siliconflow, sglang, gateway, edgeone, doubao, modelscope, glm, qwen, qiniu, kimi, minimax, novita, mimo, atlascloud, custom
 ```
 
 ## サーバーサイドマルチモデル設定
@@ -466,3 +466,4 @@ TEMPERATURE=0  # より決定論的な出力（ダイアグラムに推奨）
     ベース URL 欄の下にヒントを表示したい、またはピッカーに注記を表示したいプロバイダーには、4 つの UI 言語（`en`、`zh`、`ja`、`zh-Hant`）をすべて含む `baseUrlHint` または `note` オブジェクトを追加します。モデル一覧をオンラインで取得できないプロバイダーは、`modelList` の代わりに短い `models` リストを持ちます。
 2. `env.example` に `ACME_API_KEY` と `ACME_BASE_URL` を追加します（各レコードの変数名がそこに現れることをユニットテストが確認します）。
 3. `docs/en`、`docs/cn`、`docs/ja` のこのドキュメントにセクションを追加します。
+4. `tests/unit/provider-matrix.test.ts` 先頭の 2 つのリスト（`MATRIX_PROVIDERS` と `MATRIX_MODEL_IDS`）に追加し、`npx vitest run tests/unit/provider-matrix.test.ts -u` で動作スナップショットを再生成します。追加される行はこのプロバイダーのものだけで、既存の行は変わってはいけません。`tests/unit/providers.test.ts` にはピッカーのグループと、サーバーの動作を変えるプロバイダーの集合（自動検出、system メッセージが 1 つだけ）が書き出されているので、そこにも追加します。3 つの README のプロバイダー数と、このドキュメントの `AI_PROVIDER` の選択肢一覧も更新します。

docs/plans/2026-10-provider-refactor.md

@@ -740,3 +740,18 @@ Docker：.github/workflows/docker-build.yml 在每个 PR 上已经构建 standal
 8. 行数：lib/ai-providers.ts 1305、lib/types/model-config.ts 180、lib/provider-setup.ts 85、lib/provider-models.ts 251、lib/admin/providers.ts 306、lib/providers.ts 559，合计 2686 行，改动前 2594 行。方案估计约 2430。多出的部分是记录字段的注释（ProviderDef 的 20 个字段各有说明）、resolveEndpoint 里保留的安全规则说明、custom 记录和 Azure 的地址提示。本方案的收益在改动面和单点决策，行数上没有收益，这一点与第 7 节的说明一致。
 
 核对结果：单元测试 66 个文件 749 个用例全部通过（含 tests/unit/canvas-import-boundary.test.ts，它在 worktree 里安装 node_modules 后才能通过）；`tsc --noEmit` 无错；`biome ci` 无错误，37 条警告全部在未改动的文件里；e2e 五个文件 65 个用例通过（settings-providers 27、settings-bedrock 8、provider-models 20、model-test 2、settings-tabs-sync 8），其中"the provider list shows what needs attention"在并行运行时超时一次，单独运行通过。层外按 provider 名的判断剩 6 处，全部在 lib/admin/providers.ts 的 deriveEnvUpdates 和 derivedEnvKeys 里。真实 key 的检查（第 5.6 节）没有做：这台机器上只有 Bedrock 的 AWS 凭据，重构前已用它跑通过 GPT-6 Luna 和 Claude Haiku 4.5 两次连接测试，重构后待所有者按清单验收。
+
+### 合并前评审（2026-10-12）
+
+PR #988 由五个模型评审（Fable 5.1、Opus 5.5、Sonnet 5.5、Codex GPT-6 Astra、Codex GPT-6.1 Sol），同一份清单的五种表述。五份都没有发现行为回退或安全问题：Astra 用程序重建旧逻辑比对了 291,600 个输入组合，Sonnet 把旧代码解包后重新生成快照并比对了 43,200 个配额组合，Sol 比对了 4,512 个，Fable 和 Opus 逐段人工比对。合并后的逐条结论在 PR 的评审记录里；按它们改了以下内容：
+
+- 自动拉取模型列表只填充列表，不再打开选择器，失败也不显示错误（五位都指出弹出的模态选择器会抢走正在输入的焦点）；同一服务商同时只发一个列表请求；回到列表再进入同一家时重新记录基线；SGLang 预填的本地示例地址不触发拉取。
+- 旧配置里保存着 Azure 占位地址的条目仍判为"未填地址"（hasCredentials 里两行兼容判断）。
+- custom 和 Azure 的地址输入框标签改为"必填"（新字典键 baseUrlRequired）。
+- PROVIDER_INFO 别名删除，三个源文件和四个测试改用 PROVIDERS；bedrock、doubao、sglang 记录里不会被读到的 logo 删除；ModelListStyle、ProviderGroupId 的再导出和 KeySource、Endpoint、resolveEndpoint 的导出删除；SINGLE_SYSTEM_PROVIDERS 删除，聊天路由直接读 singleSystem。
+- 改名：PROVIDER_ENV_VARS 改为 REQUIRED_KEY_VARS，serverCredentialError 的局部变量 keyEnv 改为 requiredKeyEnv，resolveEndpoint 的局部变量 configuredBaseURL 改为 configuredUrl，类型 Copy 改为 LocalizedText；七处过时注释改写。
+- 测试：快照矩阵加 6 种输入形状（只带 Vertex key、带会话令牌的 AWS 密钥对、请求头加地址、可信地址加 key、key 加服务器模型自己的地址变量、只有 "/"），共 22 种，5843 行；新增的 1566 行在 99ced88 的旧代码上重新生成后逐行相同，差异只有 custom 的 200 行和两段报错文案的顺序。矩阵测试和服务器凭据测试清理全部相关环境变量；管理面板变量名测试覆盖 custom 并与 PROVIDER_NAMES 比对；用被测函数公式算期望值的用例删除；singleSystem、listNeedsNoKey、sdkKnowsEndpoint 三个集合和参与自动检测的 22 家逐一写明。
+- 文档：三份 README 改为 25 家并提到 OpenAI 兼容预设；三份服务商文档的 AI_PROVIDER 可选值补全、Azure 示例地址补 /openai 后缀、"新增服务商"加第 4 步（要同步的测试）。
+- 两个重构之前就有的问题单独提交：重定向守卫跨域时同时清掉 x-access-code；edgeOneEndpoint 只在请求的 Origin 头与 Host 或 X-Forwarded-Host 相符时采用它，否则用请求地址自己的 origin。
+
+评审者指出但有意不改的：另外三段报错文案和管理面板下拉框的顺序随记录顺序变化（待决问题 2 已接受）；服务器配置里原型链名字从放行变为拒绝（收紧）；日志少了候选 key 数量；usesServerCredentials 对数组变量多抽一次随机数；fixedCredentials、ownRequestPath、listNeedsNoKey 可由其他字段推出但保留为显式事实。

hooks/use-model-config.ts

@@ -2,6 +2,7 @@
 
 import { useCallback, useEffect, useState } from "react"
 import { getApiEndpoint } from "@/lib/base-path"
+import { PROVIDERS } from "@/lib/providers"
 import type { FlattenedServerModel } from "@/lib/server-model-config"
 import { STORAGE_KEYS } from "@/lib/storage"
 import {
@@ -13,13 +14,12 @@ import {
     flattenModels,
     type ModelConfig,
     type MultiModelConfig,
-    PROVIDER_INFO,
     type ProviderConfig,
     type ProviderName,
 } from "@/lib/types/model-config"
 
 const isKnownProvider = (p: { provider: string }) =>
-    Object.hasOwn(PROVIDER_INFO, p.provider)
+    Object.hasOwn(PROVIDERS, p.provider)
 
 /**
  * The stored config without providers this version does not know (saved

lib/ai-providers.ts

@@ -41,11 +41,6 @@ interface ModelConfig {
     provider: ProviderName
 }
 
-// Providers that only support a single system message
-export const SINGLE_SYSTEM_PROVIDERS = new Set<ProviderName>(
-    PROVIDER_NAMES.filter((p) => PROVIDERS[p].singleSystem),
-)
-
 /**
  * Normalize MiniMax base URL for AI SDK compatibility.
  * MiniMax supports Anthropic-compatible and OpenAI-compatible endpoints.
@@ -203,10 +198,7 @@ function resolveApiKey(
     }
 }
 
-/**
- * Resolve base URL from custom env var name or default env var.
- * Supports multiple base URLs per provider via ai-models.json baseUrlEnv config.
- */
+/** The server's base URL: a server model's own variable (baseUrlEnv) or the default one */
 function resolveBaseUrlEnv(
     overrides: ClientOverrides | undefined,
     defaultEnvVar: string,
@@ -484,10 +476,10 @@ export function envVarsOf(provider: ProviderName): {
     }
 }
 
-// Map of provider to required environment variable. null where the server
-// needs no key of this kind: Bedrock (the AWS SDK uses an IAM role or the
+// The key variable the server must have for each provider; null where it
+// needs none of this kind: Bedrock (the AWS SDK uses an IAM role or the
 // AWS_* variables), local Ollama, EdgeOne (the site's own function)
-const PROVIDER_ENV_VARS = Object.fromEntries(
+const REQUIRED_KEY_VARS = Object.fromEntries(
     PROVIDER_NAMES.map((p) => {
         const { credential } = PROVIDERS[p]
         const required = credential === "apiKey" || credential === "vertexKey"
@@ -504,7 +496,8 @@ const PROVIDER_ENV_VARS = Object.fromEntries(
  * either variable; a custom variable without a value fails, with no fall
  * back to the default one; a provider with a resourceNameEnv (Azure) then
  * needs its base URL variable, the server model's own URL variable or the
- * resource name. Providers with no required key variable pass.
+ * resource name. Providers with no required key variable pass unless a
+ * custom variable was given.
  */
 function serverCredentialError(
     provider: ProviderName,
@@ -523,20 +516,20 @@ function serverCredentialError(
     }
 
     const { altKeyEnv, resourceNameEnv } = PROVIDERS[provider]
-    const keyEnv = PROVIDER_ENV_VARS[provider]
+    const requiredKeyEnv = REQUIRED_KEY_VARS[provider]
     if (altKeyEnv && !customApiKeyEnv) {
         const hasCredential = !!(
-            (keyEnv && process.env[keyEnv]) ||
+            (requiredKeyEnv && process.env[requiredKeyEnv]) ||
             process.env[altKeyEnv]
         )
         if (!hasCredential) {
             return (
-                `Either ${keyEnv} or ${altKeyEnv} environment variable is required for ${provider} provider. ` +
+                `Either ${requiredKeyEnv} or ${altKeyEnv} environment variable is required for ${provider} provider. ` +
                 `Please set one in your .env.local file.`
             )
         }
     } else {
-        const requiredVar = customApiKeyEnv || keyEnv
+        const requiredVar = customApiKeyEnv || requiredKeyEnv
         if (requiredVar && !process.env[requiredVar]) {
             return (
                 `${requiredVar} environment variable is required for ${provider} provider. ` +
@@ -545,7 +538,8 @@ function serverCredentialError(
         }
     }
 
-    // The SDK builds the URL from the resource name when there is no URL
+    // The SDK builds the URL from the resource name when there is no URL.
+    // Only Azure has one, and the text stays as it was (tests freeze it)
     if (resourceNameEnv) {
         const baseUrlEnv = envVarsOf(provider).baseUrl as string
         const hasBaseUrl =
@@ -569,7 +563,7 @@ function serverCredentialError(
 function detectProvider(): ProviderName | null {
     const configuredProviders = PROVIDER_NAMES.filter(
         (p) =>
-            PROVIDER_ENV_VARS[p] !== null && serverCredentialError(p) === null,
+            REQUIRED_KEY_VARS[p] !== null && serverCredentialError(p) === null,
     )
     return configuredProviders.length === 1 ? configuredProviders[0] : null
 }
@@ -606,10 +600,10 @@ function bedrockRuntimeUrl(region: string): string {
     return `https://bedrock-runtime.${region}.${suffix}`
 }
 
-export type KeySource = "client" | "server" | "none"
+type KeySource = "client" | "server" | "none"
 
 /** Where and how to call a provider, once credentials are resolved */
-export interface Endpoint {
+interface Endpoint {
     apiKey?: string
     /** Anthropic Bearer auth (ANTHROPIC_AUTH_TOKEN), server only */
     authToken?: string
@@ -639,7 +633,7 @@ export interface Endpoint {
  * drops one pasted endpoint path per call, so it runs once, in the caller).
  * Bedrock gets only keySource: bedrockModel() builds its SDK parameters.
  */
-export function resolveEndpoint(
+function resolveEndpoint(
     provider: ProviderName,
     overrides?: ClientOverrides,
 ): Endpoint {
@@ -735,7 +729,7 @@ export function resolveEndpoint(
             // An API key and a base URL from <PREFIX>_API_KEY /
             // <PREFIX>_BASE_URL, or a server model's apiKeyEnv / baseUrlEnv
             const key = resolveApiKey(overrides, vars.apiKey)
-            const configuredBaseURL = resolveBaseURL(
+            const configuredUrl = resolveBaseURL(
                 overrides?.apiKey,
                 clientUrl,
                 resolveBaseUrlEnv(overrides, vars.baseUrl as string),
@@ -746,7 +740,7 @@ export function resolveEndpoint(
             // The others get the record's https default (a local default,
             // SGLang's 127.0.0.1, only fills the settings form).
             const baseURL =
-                configuredBaseURL ||
+                configuredUrl ||
                 (def.sdkKnowsEndpoint &&
                 !(def.sdk === "openai" && overrides?.apiKey)
                     ? undefined
@@ -754,7 +748,7 @@ export function resolveEndpoint(
             return {
                 apiKey: key.value,
                 baseURL,
-                configuredBaseURL: !!configuredBaseURL,
+                configuredBaseURL: !!configuredUrl,
                 guarded,
                 keySource: key.source,
                 selectedKeyEnv: key.selectedKeyEnv,
@@ -1069,12 +1063,12 @@ export function getAIModel(clientOverrides?: ClientOverrides): ModelConfig {
             console.log(`[AI Provider] Auto-detected provider: ${provider}`)
         } else {
             // List configured providers for better error message
-            const configured = Object.entries(PROVIDER_ENV_VARS)
+            const configured = Object.entries(REQUIRED_KEY_VARS)
                 .filter(([, envVar]) => envVar && process.env[envVar as string])
                 .map(([p]) => p)
 
             if (configured.length === 0) {
-                const keys = Object.entries(PROVIDER_ENV_VARS)
+                const keys = Object.entries(REQUIRED_KEY_VARS)
                     .filter(([, envVar]) => envVar)
                     .map(([p, envVar]) => `- ${envVar} for ${p}`)
                 throw new Error(

lib/i18n/dictionaries/en.json

@@ -298,6 +298,7 @@
         "mayNotDraw": "models.dev lists no tool call support for this model, so it may not be able to draw.",
         "requestUrl": "Requests go to {url}",
         "baseUrlWithExample": "Base URL (optional, e.g. {example})",
+        "baseUrlRequired": "Base URL (required)",
         "customEndpoint": "Custom endpoint URL",
         "models": "Models",
         "customModelId": "Custom model ID...",

lib/i18n/dictionaries/ja.json

@@ -253,6 +253,7 @@
         "mayNotDraw": "models.dev によると、このモデルはツール呼び出しに対応していないため、作図できない可能性があります。",
         "requestUrl": "リクエスト先: {url}",
         "baseUrlWithExample": "ベース URL（オプション、例: {example}）",
+        "baseUrlRequired": "ベース URL（必須）",
         "customEndpoint": "カスタムエンドポイント URL",
         "models": "モデル",
         "customModelId": "カスタムモデル ID...",

lib/i18n/dictionaries/zh-Hant.json

@@ -298,6 +298,7 @@
         "mayNotDraw": "models.dev 顯示這個模型不支援工具呼叫，可能無法繪圖。",
         "requestUrl": "請求將傳送至 {url}",
         "baseUrlWithExample": "基礎 URL（可選，例如 {example}）",
+        "baseUrlRequired": "基礎 URL（必填）",
         "customEndpoint": "自訂端點 URL",
         "models": "模型",
         "customModelId": "自訂模型 ID...",

lib/i18n/dictionaries/zh.json

@@ -298,6 +298,7 @@
         "mayNotDraw": "models.dev 显示这个模型不支持工具调用，可能无法画图。",
         "requestUrl": "请求将发往 {url}",
         "baseUrlWithExample": "基础 URL（可选，例如 {example}）",
+        "baseUrlRequired": "基础 URL（必填）",
         "customEndpoint": "自定义端点 URL",
         "models": "模型",
         "customModelId": "自定义模型 ID...",

lib/provider-setup.ts

@@ -8,8 +8,6 @@ import {
 } from "@/lib/providers"
 import type { ProviderConfig, ProviderName } from "@/lib/types/model-config"
 
-export type { ProviderGroupId }
-
 /** The provider picker's groups, each provider in exactly one, in record order */
 export const PROVIDER_GROUPS: {
     id: ProviderGroupId
@@ -44,6 +42,8 @@ export function filterProviderGroups(query: string) {
     })).filter((group) => group.providers.length > 0)
 }
 
+const LEGACY_AZURE_PLACEHOLDER = "https://your-resource.openai.azure.com/openai"
+
 /** The credentials a test or a chat request needs are filled in */
 export function hasCredentials(p: ProviderConfig): boolean {
     const def = PROVIDERS[p.provider]
@@ -59,10 +59,15 @@ export function hasCredentials(p: ProviderConfig): boolean {
         case "none":
         case "optionalKey":
             return true
-        case "apiKey":
-            // Without a default URL in the record (Azure) the user's own is
-            // part of the credentials
-            return !!p.apiKey && (!!def.defaultBaseUrl || !!p.baseUrl)
+        case "apiKey": {
+            // Without a default URL in the record (Azure, custom) the user's
+            // own is part of the credentials. Entries saved while Azure still
+            // had a placeholder default hold that placeholder; it names no
+            // real resource
+            const baseUrl =
+                p.baseUrl === LEGACY_AZURE_PLACEHOLDER ? "" : p.baseUrl
+            return !!p.apiKey && (!!def.defaultBaseUrl || !!baseUrl)
+        }
     }
 }
 

lib/providers.ts

@@ -46,7 +46,7 @@ export type ModelListStyle =
 export type ProviderGroup = "vendors" | "aggregators" | "cloud" | "selfHosted"
 
 /** One sentence in every UI language */
-export type Copy = Record<Locale, string>
+export type LocalizedText = Record<Locale, string>
 
 export interface ProviderDef {
     label: string
@@ -70,8 +70,9 @@ export interface ProviderDef {
     resourceNameEnv?: string
     /**
      * The official endpoint, also the form's placeholder. A non-https value
-     * (SGLang's 127.0.0.1) only fills the form: the server never calls it.
-     * Missing for a credential "apiKey" provider: the user must enter one
+     * (SGLang's 127.0.0.1) only fills the form; the server never falls back
+     * to it. A credential "apiKey" provider without one (Azure, custom)
+     * needs the user's URL
      */
     defaultBaseUrl?: string
     /** The SDK has the official endpoint built in: pass no baseURL unless one is configured */
@@ -92,12 +93,12 @@ export interface ProviderDef {
     fixedCredentials?: true
     /** models.dev logo name when it differs from the key */
     logo?: string
-    /** A Lucide icon for providers without a logo on models.dev */
+    /** A Lucide icon shown instead of a models.dev logo */
     icon?: "cloud" | "server" | "sparkles"
     /** The note shown under the name in the picker (Bedrock: "AWS credentials") */
-    note?: Copy
+    note?: LocalizedText
     /** A hint under the base URL field (MiniMax: which path selects which protocol) */
-    baseUrlHint?: Copy
+    baseUrlHint?: LocalizedText
     /** The folded options start open: the base URL usually needs changing */
     optionsOpen?: true
 }
@@ -171,7 +172,6 @@ const defs = {
         defaultBaseUrl: "https://ark.cn-beijing.volces.com/api/v3",
         apiKeyUrl:
             "https://console.volcengine.com/ark/region:ark+cn-beijing/apiKey",
-        logo: "bytedance",
         icon: "sparkles",
         // Volcengine Ark ids use the dash form
         models: [
@@ -356,7 +356,6 @@ const defs = {
         envPrefix: null,
         fixedCredentials: true,
         ownRequestPath: true,
-        logo: "amazon-bedrock",
         icon: "cloud",
         note: {
             en: "AWS credentials",
@@ -503,10 +502,10 @@ const defs = {
         credential: "apiKey",
         group: "selfHosted",
         envPrefix: "SGLANG",
-        // A local example: the server never calls it, see publicDefaultUrl
+        // A local example that only fills the form; the server never falls
+        // back to it (publicDefaultUrl)
         defaultBaseUrl: "http://127.0.0.1:8000/v1",
         modelList: "openai",
-        logo: "openai",
         icon: "server",
         optionsOpen: true,
         note: {
@@ -531,10 +530,10 @@ const defs = {
         // Open-source chat templates reject several system messages
         singleSystem: true,
         note: {
-            en: "Any OpenAI-compatible URL and key",
-            zh: "任何 OpenAI 兼容地址和 key",
-            ja: "OpenAI 互換の URL とキー",
-            "zh-Hant": "任何 OpenAI 相容位址和 key",
+            en: "Your URL and key",
+            zh: "填地址和 Key",
+            ja: "URL とキー",
+            "zh-Hant": "填位址和 Key",
         },
     },
 } satisfies Record<string, ProviderDef>

lib/server-model-config.ts

@@ -1,12 +1,11 @@
 import fs from "fs/promises"
 import path from "path"
 import { z } from "zod"
-import type { ProviderName } from "@/lib/types/model-config"
-import { PROVIDER_INFO } from "@/lib/types/model-config"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
 
 export const ProviderNameSchema: z.ZodType<ProviderName> = z
     .string()
-    .refine((val): val is ProviderName => Object.hasOwn(PROVIDER_INFO, val), {
+    .refine((val): val is ProviderName => Object.hasOwn(PROVIDERS, val), {
         message: "Invalid provider name",
     })
 
@@ -81,7 +80,7 @@ function configFromCommaSeparatedAiModel(): ServerModelsConfig | null {
         )
         return null
     }
-    if (!Object.hasOwn(PROVIDER_INFO, aiProvider)) {
+    if (!Object.hasOwn(PROVIDERS, aiProvider)) {
         console.warn(
             `[server-model-config] AI_PROVIDER="${aiProvider}" is not a known provider; skipping multi-model fallback.`,
         )
@@ -102,7 +101,7 @@ function configFromCommaSeparatedAiModel(): ServerModelsConfig | null {
     return {
         providers: [
             {
-                name: PROVIDER_INFO[providerName]?.label || providerName,
+                name: PROVIDERS[providerName]?.label || providerName,
                 provider: providerName,
                 models,
                 default: true,
@@ -195,7 +194,7 @@ export async function loadFlattenedServerModels(): Promise<
 
     for (const p of cfg.providers) {
         const providerLabel =
-            p.name || PROVIDER_INFO[p.provider]?.label || p.provider
+            p.name || PROVIDERS[p.provider]?.label || p.provider
 
         // Use slugified name for unique ID (supports multiple API keys per provider)
         const nameSlug = slugify(p.name)

lib/types/model-config.ts

@@ -2,12 +2,7 @@
 
 import { PROVIDERS, type ProviderName } from "@/lib/providers"
 
-// The provider record, under the name the rest of the app imports it by
-export {
-    type ModelListStyle,
-    PROVIDERS as PROVIDER_INFO,
-    type ProviderName,
-} from "@/lib/providers"
+export type { ProviderName } from "@/lib/providers"
 
 // Individual model configuration
 export interface ModelConfig {

tests/e2e/settings-providers.spec.ts

@@ -77,9 +77,15 @@ test("a first provider: pick it, fill in the key, test, use it", async ({
     await expect(testButton).toBeDisabled()
     await expect(dialog.getByText("Fill in the API key first.")).toBeVisible()
 
-    // The key is in: the list is fetched once and opens; pick a model
+    // The key is in: the list is fetched once by itself, without taking the
+    // focus; it is behind "Browse models"
     await dialog.locator("#api-key").fill("sk-1234")
     await expect(dialog.getByTestId("step-1-done")).toBeVisible()
+    const browse = dialog.getByRole("button", { name: "Browse models" })
+    await expect(browse).toBeVisible()
+    await expect(dialog.locator("#api-key")).toBeFocused()
+    expect(listedWith).toEqual(["sk-1234"])
+    await browse.click()
     await page.getByRole("option", { name: "deepseek-v4-pro" }).click()
     expect(listedWith).toEqual(["sk-1234"])
     await expect(dialog.locator('input[title="deepseek-v4-pro"]')).toBeVisible()
@@ -565,7 +571,8 @@ test("a local server's base URL is shown from the start", async ({ page }) => {
 test("Azure needs its resource URL before it counts as connected", async ({
     page,
 }) => {
-    // Azure has no default URL: a new entry starts without one
+    // An entry saved while Azure still had a placeholder default URL: the
+    // placeholder names no resource, so the entry is not set up yet
     await openApp(page, {
         config: {
             version: 1,
@@ -574,6 +581,7 @@ test("Azure needs its resource URL before it counts as connected", async ({
                     id: "z1",
                     provider: "azure",
                     apiKey: "k",
+                    baseUrl: "https://your-resource.openai.azure.com/openai",
                     models: [{ id: "m1", modelId: "gpt-6-astra" }],
                 },
             ],
@@ -716,10 +724,13 @@ test("an empty model list says so and opens nothing", async ({ page }) => {
     ).toBeVisible()
     // The picker did not open by itself
     await expect(page.getByRole("listbox")).toHaveCount(0)
-    // A new key fetches the list again by itself and opens it once it has models
+    // A new key fetches the list again by itself; the list waits behind
+    // "Browse models" and the cursor stays in the key field
     models = [{ id: "fresh-model" }]
     await dialog.locator("#api-key").fill("k-new")
     await expect(
-        page.getByRole("option", { name: "fresh-model" }),
+        dialog.getByRole("button", { name: "Browse models" }),
     ).toBeVisible()
+    await expect(page.getByRole("listbox")).toHaveCount(0)
+    await expect(dialog.locator("#api-key")).toBeFocused()
 })

tests/unit/admin-providers.test.ts

@@ -14,6 +14,7 @@ import {
     validateAdminProviders,
 } from "@/lib/admin/providers"
 import { _resetForTests, saveSettings } from "@/lib/admin/settings"
+import { PROVIDER_NAMES } from "@/lib/providers"
 import { loadRawServerModelsConfig } from "@/lib/server-model-config"
 
 let tmpDir: string
@@ -501,7 +502,9 @@ describe("credEnvNames", () => {
             edgeone: null,
             ollama: null,
             sglang: "SGLANG",
+            custom: "CUSTOM",
         }
+        expect(Object.keys(expected).sort()).toEqual([...PROVIDER_NAMES].sort())
         for (const [p, prefix] of Object.entries(expected)) {
             const first = credEnvNames(p as StoredAdminProvider["provider"], 0)
             const third = credEnvNames(p as StoredAdminProvider["provider"], 2)
@@ -521,6 +524,5 @@ describe("credEnvNames", () => {
                     : {},
             ])
         }
-        expect(Object.keys(expected)).toHaveLength(24)
     })
 })

tests/unit/provider-matrix.test.ts

@@ -3,8 +3,9 @@
  * of client override and every server environment it records what
  * getAIModel hands to the SDK factory (or the error it throws) together with
  * the answers of usesServerCredentials, usesServerEndpoint, globalBaseUrl
- * and chatRequestUrl. Each refactor step must leave the snapshot file
- * unchanged; a diff names the provider and the scenario whose behavior moved.
+ * and chatRequestUrl. A change to the provider layer must leave the
+ * existing rows unchanged (a new provider only adds rows); a diff names the
+ * provider and the scenario whose behavior moved.
  *
  * Every SDK factory is mocked to return a plain description of its options.
  * redirectGuardedFetch returns a sentinel, so the snapshot shows whether
@@ -22,12 +23,8 @@ import {
     usesServerCredentials,
     usesServerEndpoint,
 } from "@/lib/ai-providers"
-import {
-    chatRequestUrl,
-    normalizeBaseUrl,
-    PROVIDER_INFO,
-    type ProviderName,
-} from "@/lib/types/model-config"
+import { PROVIDERS, type ProviderName } from "@/lib/providers"
+import { chatRequestUrl, normalizeBaseUrl } from "@/lib/types/model-config"
 
 const hoisted = vi.hoisted(() => {
     /** An SDK factory whose models describe the factory call that made them */
@@ -130,8 +127,9 @@ vi.mock("ollama-ai-provider-v2", () => ({
 }))
 
 /**
- * The providers in the order of today's ProviderName union. Written out so
- * the snapshot's row order does not follow the order of the provider record.
+ * The providers in the order they had before the record existed, then the
+ * ones added since. Written out so the snapshot's row order does not follow
+ * the order of the provider record.
  */
 const MATRIX_PROVIDERS: ProviderName[] = [
     "openai",
@@ -161,7 +159,7 @@ const MATRIX_PROVIDERS: ProviderName[] = [
     "custom",
 ]
 
-/** The model id each provider runs in the matrix (the first suggested one) */
+/** The model id each provider runs in the matrix (the first of its former suggested list, or test-model) */
 const MATRIX_MODEL_IDS: Record<ProviderName, string> = {
     openai: "gpt-6.1-sol",
     anthropic: "claude-opus-5-5",
@@ -269,7 +267,7 @@ const ENVIRONMENTS: Record<string, (p: ProviderName) => Env> = {
 const CLIENT_URL = "https://u.example/v1"
 const CLIENT_KEY = "client-key"
 
-/** Sixteen shapes of client override; some need variables of their own */
+/** Twenty-two shapes of client override; some need variables of their own */
 const SHAPES: Record<
     string,
     { overrides: Omit<ClientOverrides, "provider" | "modelId">; env?: Env }
@@ -324,6 +322,40 @@ const SHAPES: Record<
     keyAndPrivateUrl: {
         overrides: { apiKey: CLIENT_KEY, baseUrl: "http://10.0.0.5:8000/v1" },
     },
+    // The Vertex key alone goes to the official endpoint
+    vertexKeyOnly: { overrides: { vertexApiKey: "client-vertex-key" } },
+    // Temporary AWS credentials carry a session token
+    awsPairWithSession: {
+        overrides: {
+            awsAccessKeyId: "client-id",
+            awsSecretAccessKey: "client-secret",
+            awsSessionToken: "client-session",
+            awsRegion: "ap-northeast-1",
+        },
+    },
+    // The site's cookies and access code, as the routes pass them for EdgeOne
+    headersAndUrl: {
+        overrides: {
+            baseUrl: CLIENT_URL,
+            headers: { cookie: "eo_token=t", "x-access-code": "code" },
+        },
+    },
+    // The admin panel's Test of an entry with a key and the server's own URL
+    trustedUrlAndKey: {
+        overrides: {
+            apiKey: CLIENT_KEY,
+            baseUrl: CLIENT_URL,
+            trustedBaseUrl: true,
+        },
+    },
+    // A user's key with a server model's own URL variable: the key must not
+    // go to that URL
+    keyAndUrlEnv: {
+        overrides: { apiKey: CLIENT_KEY, baseUrlEnv: "CUSTOM_URL" },
+        env: { CUSTOM_URL: "https://custom-env.example/v1" },
+    },
+    // "/" alone cleans up to no URL at all
+    slashOnly: { overrides: { baseUrl: "/" } },
 }
 
 /** The shapes that carry a client URL, for the MiniMax /anthropic probe */
@@ -421,7 +453,7 @@ async function matrix(
 // Variables the layer reads, cleared before the matrix runs so the
 // machine's own environment cannot reach the snapshot
 const AMBIENT =
-    /_API_KEY|_BASE_URL|_RESOURCE_NAME|_AUTH_TOKEN|_REASONING_|_THINKING_|^AWS_|^ADMIN_|^AI_|^GOOGLE_TOP_|^OLLAMA_|^NEXT_AI_DRAWIO_DESKTOP$|^ALLOW_PRIVATE_URLS$|^DYNAMODB_QUOTA_TABLE$|^VALIDATION_MODEL$/
+    /_API_KEY|_BASE_URL|_RESOURCE_NAME|_AUTH_TOKEN|_REASONING_|_THINKING_|^AWS_|^ADMIN_|^AI_|^GOOGLE_TOP_|^OLLAMA_|^NEXT_AI_DRAWIO_DESKTOP$|^ALLOW_PRIVATE_URLS$|^DYNAMODB_QUOTA_TABLE$|^VALIDATION_MODEL$|^CUSTOM_KEY|^CUSTOM_URL$|^KEY_[ABC]$/
 const saved: Record<string, string | undefined> = {}
 
 beforeAll(() => {
@@ -446,12 +478,12 @@ afterAll(() => {
 describe("provider behavior snapshot", () => {
     it("covers every provider", () => {
         expect([...MATRIX_PROVIDERS].sort()).toEqual(
-            Object.keys(PROVIDER_INFO).sort(),
+            Object.keys(PROVIDERS).sort(),
         )
     })
 
     it("matches the recorded behavior", async () => {
-        // The matrix: 25 providers, 16 shapes, 9 environments
+        // The matrix: 25 providers, 22 shapes, 9 environments
         for (const provider of MATRIX_PROVIDERS) {
             await matrix(provider, MATRIX_MODEL_IDS[provider])
         }

tests/unit/provider-setup.test.ts

@@ -6,8 +6,8 @@ import {
     PROVIDER_GROUPS,
     providerStatus,
 } from "@/lib/provider-setup"
-import { PROVIDER_NAMES, PROVIDERS } from "@/lib/providers"
-import { PROVIDER_INFO, type ProviderConfig } from "@/lib/types/model-config"
+import { PROVIDERS } from "@/lib/providers"
+import type { ProviderConfig } from "@/lib/types/model-config"
 import { useUiStore } from "@/stores/ui-store"
 
 const provider = (p: Partial<ProviderConfig>): ProviderConfig => ({
@@ -21,12 +21,12 @@ const provider = (p: Partial<ProviderConfig>): ProviderConfig => ({
 describe("provider groups", () => {
     it("hold every provider exactly once", () => {
         const grouped = PROVIDER_GROUPS.flatMap((g) => g.providers)
-        expect([...grouped].sort()).toEqual(Object.keys(PROVIDER_INFO).sort())
+        expect([...grouped].sort()).toEqual(Object.keys(PROVIDERS).sort())
         expect(new Set(grouped).size).toBe(grouped.length)
     })
 
     it("offer known providers as popular ones", () => {
-        for (const p of POPULAR_PROVIDERS) expect(PROVIDER_INFO[p]).toBeTruthy()
+        for (const p of POPULAR_PROVIDERS) expect(PROVIDERS[p]).toBeTruthy()
     })
 
     it("are searched by label or name, ignoring case and spaces", () => {
@@ -60,6 +60,25 @@ describe("hasCredentials", () => {
                 },
                 true,
             ],
+            // The placeholder Azure once wrote into new entries names no resource
+            [
+                {
+                    provider: "azure",
+                    apiKey: "k",
+                    baseUrl: "https://your-resource.openai.azure.com/openai",
+                },
+                false,
+            ],
+            // The OpenAI-compatible preset has no default URL either
+            [{ provider: "custom", apiKey: "k" }, false],
+            [
+                {
+                    provider: "custom",
+                    apiKey: "k",
+                    baseUrl: "http://127.0.0.1:1234/v1",
+                },
+                true,
+            ],
             // SGLang's local default fills the form, so a key is enough here
             [{ provider: "sglang", apiKey: "k" }, true],
             [{ provider: "bedrock", apiKey: "k" }, false],
@@ -89,23 +108,6 @@ describe("hasCredentials", () => {
             expect([p, hasCredentials(provider(p))]).toEqual([p, expected])
         }
     })
-
-    it("asks every provider for a key, an AWS pair, a Vertex key or nothing", () => {
-        // With only a key filled in, by the record's credential kind
-        for (const p of PROVIDER_NAMES) {
-            const { credential, defaultBaseUrl } = PROVIDERS[p]
-            const expected =
-                credential === "none" || credential === "optionalKey"
-                    ? true
-                    : credential === "apiKey"
-                      ? !!defaultBaseUrl
-                      : false
-            expect([
-                p,
-                hasCredentials(provider({ provider: p, apiKey: "k" })),
-            ]).toEqual([p, expected])
-        }
-    })
 })
 
 describe("providerStatus", () => {

tests/unit/providers.test.ts

@@ -12,7 +12,6 @@ import { envVarsOf } from "@/lib/ai-providers"
 import { i18n } from "@/lib/i18n/config"
 import { POPULAR_PROVIDERS, PROVIDER_GROUPS } from "@/lib/provider-setup"
 import { PROVIDER_NAMES, PROVIDERS, publicDefaultUrl } from "@/lib/providers"
-import { PROVIDER_INFO } from "@/lib/types/model-config"
 
 vi.mock("@/lib/admin/settings", () => ({
     loadSettings: () => ({}),
@@ -22,18 +21,44 @@ vi.mock("@/lib/admin/settings", () => ({
 const sorted = (list: Iterable<string>) => [...list].sort()
 
 describe("the provider record", () => {
-    it("is what the rest of the app imports as PROVIDER_INFO", () => {
-        expect(PROVIDER_INFO).toBe(PROVIDERS)
-        expect(PROVIDER_NAMES).toHaveLength(25)
-    })
+    // The fields that change what the server does are spelled out here, so
+    // a slip in one record fails a test instead of changing a request
+    const withField = (
+        field: "singleSystem" | "listNeedsNoKey" | "sdkKnowsEndpoint",
+    ) => sorted(PROVIDER_NAMES.filter((p) => PROVIDERS[p][field]))
 
-    it("has 22 providers taking part in server key auto-detection", () => {
+    it("lets the server auto-detect exactly the providers that need a key", () => {
         // credential apiKey or vertexKey: the providers whose <P>_API_KEY the
         // server must have; aws, optionalKey and none need no key
         const detected = PROVIDER_NAMES.filter((p) =>
             ["apiKey", "vertexKey"].includes(PROVIDERS[p].credential),
         )
-        expect(detected).toHaveLength(22)
+        expect(sorted(detected)).toEqual(
+            sorted([
+                "openai",
+                "anthropic",
+                "google",
+                "deepseek",
+                "qwen",
+                "doubao",
+                "glm",
+                "kimi",
+                "minimax",
+                "mimo",
+                "openrouter",
+                "aihubmix",
+                "siliconflow",
+                "modelscope",
+                "novita",
+                "atlascloud",
+                "qiniu",
+                "gateway",
+                "vertexai",
+                "azure",
+                "sglang",
+                "custom",
+            ]),
+        )
         // Ollama has a key variable too, an optional one
         const withKeyVar = PROVIDER_NAMES.filter((p) => !!envVarsOf(p).apiKey)
         expect(sorted(detected)).toEqual(
@@ -41,6 +66,40 @@ describe("the provider record", () => {
         )
     })
 
+    it("merges system messages for the providers that reject several", () => {
+        expect(withField("singleSystem")).toEqual(
+            sorted([
+                "minimax",
+                "glm",
+                "qwen",
+                "kimi",
+                "qiniu",
+                "novita",
+                "mimo",
+                "custom",
+            ]),
+        )
+    })
+
+    it("lists models without a key for the providers with a public or local list", () => {
+        expect(withField("listNeedsNoKey")).toEqual(
+            sorted(["ollama", "openrouter", "aihubmix"]),
+        )
+    })
+
+    it("leaves the base URL to the SDKs that know their endpoint", () => {
+        expect(withField("sdkKnowsEndpoint")).toEqual(
+            sorted([
+                "openai",
+                "google",
+                "azure",
+                "openrouter",
+                "gateway",
+                "deepseek",
+            ]),
+        )
+    })
+
     it("writes every note and hint in every UI language", () => {
         for (const p of PROVIDER_NAMES) {
             for (const copy of [PROVIDERS[p].note, PROVIDERS[p].baseUrlHint]) {
@@ -59,7 +118,7 @@ describe("the provider record", () => {
         expect(publicDefaultUrl("bedrock")).toBeUndefined()
     })
 
-    it("gives the no-key and fixed-credential providers no key variable to detect", () => {
+    it("gives the no-key providers no env prefix and limits fixed credentials to non-key kinds", () => {
         for (const p of PROVIDER_NAMES) {
             const { credential, envPrefix, fixedCredentials } = PROVIDERS[p]
             if (credential === "none") expect([p, envPrefix]).toEqual([p, null])

tests/unit/server-credentials.test.ts

@@ -6,7 +6,8 @@
  * answer and every error text below.
  */
 import { beforeEach, describe, expect, it, vi } from "vitest"
-import { getAIModel, getServerProvider } from "@/lib/ai-providers"
+import { envVarsOf, getAIModel, getServerProvider } from "@/lib/ai-providers"
+import { PROVIDER_NAMES, PROVIDERS } from "@/lib/providers"
 
 vi.mock("@/lib/admin/settings", () => ({
     loadSettings: () => ({}),
@@ -22,21 +23,22 @@ vi.mock("@ai-sdk/azure", () => ({ createAzure: factory }))
 vi.mock("@ai-sdk/google-vertex", () => ({ createVertex: factory }))
 vi.mock("ollama-ai-provider-v2", () => ({ createOllama: factory }))
 
+// Every provider's key and URL variables, the alternative and resource
+// variables, and this file's own: the machine's environment must not reach
+// the checks under test
 const VARS = [
     "AI_PROVIDER",
     "AI_MODEL",
-    "ANTHROPIC_API_KEY",
-    "ANTHROPIC_AUTH_TOKEN",
-    "AZURE_API_KEY",
-    "AZURE_BASE_URL",
-    "AZURE_RESOURCE_NAME",
-    "OPENAI_API_KEY",
-    "OPENAI_BASE_URL",
-    "GOOGLE_VERTEX_API_KEY",
-    "OLLAMA_API_KEY",
     "MY_KEY",
     "MY_KEY_2",
     "MY_URL",
+    ...PROVIDER_NAMES.flatMap((p) => {
+        const { apiKey, baseUrl } = envVarsOf(p)
+        const { altKeyEnv, resourceNameEnv } = PROVIDERS[p]
+        return [apiKey, baseUrl, altKeyEnv, resourceNameEnv].filter(
+            (name): name is string => !!name,
+        )
+    }),
 ]
 
 beforeEach(() => {