Expose proxy controls for no-auth providers by JxnLexn · Pull Request #7419 · cheaper-inference/OmniRoute

JxnLexn · 2026-07-16T11:40:23Z

Summary

Allow no-auth providers to view and configure their provider-level proxy directly from the provider controls.
Thread the provider ID through synthetic no-auth proxy resolution so provider-level assignments cannot be confused by the shared noauth connection ID.

Validation

Focused proxy, count_tokens, and proxy-context tests pass after the rebase: 18/18.
Pre-commit formatting, ESLint, and repository tracked-artifact checks passed for the added changes.

Tests Added Or Updated

Added provider-specific no-auth proxy resolution coverage in tests/unit/proxy-noauth-provider-6272.test.ts.
Added count_tokens provider forwarding so the synthetic noauth connection resolves the correct provider-level proxy.
Existing proxy passthrough coverage continues to verify that provider-side count calls run inside the selected proxy context.
The dead-assignment regression coverage in tests/unit/proxy-assigned-unavailable-6246.test.ts remains part of the change.

Coverage Notes

Provider controls are covered by no-auth provider validation and proxy-resolution tests.
The count_tokens regression path is covered together with synthetic no-auth provider disambiguation.

Reviewer Notes

Validate configured and unconfigured proxy states for both account-backed and generic no-auth providers, including responsive layouts.
The count_tokens route now calls safeResolveProxy(credentials.connectionId, undefined, modelInfo.provider), so the fix(providers): Mimo Code (MiMoCode Free) doesn't use configured proxy #6272 disambiguation and [BUG] Massive issue with proxies since 3.8.44 - IP leak #6246 leak guard also apply there.
This branch is rebased onto fix(providers): honor provider proxies for a since-removed keyless provider's Vercel blocks #7380 so the shared proxy-guard conflict is already reconciled. After fix(providers): honor provider proxies for a since-removed keyless provider's Vercel blocks #7380 merges, GitHub will show this PR's incremental changes against release/v3.8.49.

gemini-code-assist

Code Review

This pull request introduces provider-level proxy configuration controls to the provider detail page, updating components like NoAuthProviderControls, NoAuthAccountCard, and NoAuthProviderCard to support rendering and configuring the proxy. The review feedback advises adding unit tests to cover these new controls in compliance with the repository style guide, and suggests extracting the proxy host to a local constant with text truncation to prevent layout breakage from long hostnames.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 52828a76e3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: ec318b1a0e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: eb2556aa9e

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 3c6a78027c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

diegosouzapw · 2026-07-17T19:57:58Z

Nice fix — the provider disambiguation bug in resolveNoAuthSharedProviderProxy (always resolving the first no-auth provider in iteration order, not the one actually in use) and the #6246 dead-proxy leak-guard gap for the synthetic noauth connectionId are both real, and the new tests (proxy-assigned-unavailable-6246.test.ts, proxy-noauth-provider-6272.test.ts) pin them down well. The NOAUTH_PROVIDER_PROXY_SUPPORTED allowlist (opencode + [provider removed at its operator's request] only) also checks out against the actual executor code — mimocode/chipotle/auggie use their own dispatcher/WebSocket paths that wouldn't honor the provider-level proxy control, so hiding it there is correct. i18n looks complete across all locales.

Two things worth a look before/after merge:

src/app/api/v1/messages/count_tokens/route.ts:68 still calls safeResolveProxy(credentials.connectionId) with the old 1-arg form, so the same disambiguation/leak-guard fix doesn't apply on that endpoint for no-auth providers. Would you thread providerId there too, or should we track it as a fast-follow?
This touches hasBlockingProxyAssignment in src/lib/db/proxies.ts, which your own fix(providers): honor provider proxies for a since-removed keyless provider's Vercel blocks #7380 also touches (moving it into a new src/lib/db/proxies/guards.ts with a different shape). Whichever of the two merges first, the other will need a manual rebase there — flagging so it doesn't surprise anyone.

Also the PR body's "No automated tests were added or updated" looks stale — looks like the later commits added real coverage in 5 test files, worth updating the description.

JxnLexn · 2026-07-17T20:54:05Z

Rebased this PR onto #7380 as a stack so the shared proxy-guard conflict is resolved now.

The rebased branch preserves:

Expose proxy controls for no-auth providers #7419's provider-aware no-auth disambiguation, including count_tokens passing modelInfo.provider to safeResolveProxy;
Expose proxy controls for no-auth providers #7419's dead-proxy regression coverage;
fix(providers): honor provider proxies for a since-removed keyless provider's Vercel blocks #7380's guard extraction and [provider removed at its operator's request] fail-closed behavior.

Focused verification after the rebase: 18/18 tests passed across the no-auth proxy, dead-assignment, count_tokens, and proxy-context suites. The PR description has also been updated; the stale “No automated tests were added or updated” note is removed.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 4198a1a5d5

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-17T20:59:11Z

+      { runWithProxyContext },
+    ] = await Promise.all([import("../../src/lib/db/proxies"), import("../utils/proxyFetch.ts")]);
+    deps = {
+      resolveProxy: () => resolveProxyForProvider("theoldllm"),


Preserve API-key proxy precedence for The Old LLM

When a The Old LLM chat is made with a per-API-key proxy and a provider/global proxy also exists, the outer chat path has already resolved the higher-priority API-key proxy via safeResolveProxy(..., apiKeyInfo.id, provider), but this new resolver fetches the provider/global proxy again and passes it as a non-null argument to runWithProxyContext. Since runWithProxyContext only inherits the current context when its argument is null, the inner provider/global proxy overrides the per-key proxy, breaking per-client egress isolation for this provider; reuse the already-resolved proxy context or only self-resolve when no context is present.

Useful? React with 👍 / 👎.

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: e0a99240ea

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-07-18T09:32:27Z

+  if (mitigation === "deny" || mitigation === "challenge") return true;
+  return (
+    (response.status === 403 || response.status === 429) &&
+    /vercel security checkpoint|"message"\s*:\s*"forbidden"/i.test(body)


Narrow Vercel denial detection to Vercel signals

When The Old LLM returns a normal app/auth 403 body such as {"error":{"message":"Forbidden"}} without the x-vercel-mitigated header, this broad body match classifies it as Vercel mitigation before isTokenRejected() runs. In that scenario fetchUpstreamWithRetry() skips the fresh-token retry and surfaces a proxy/Vercel error even though the request-token retry path was meant to handle 403s; require the Vercel header or a Vercel-specific body marker here.

Useful? React with 👍 / 👎.

…reducible wiring, campaign 2026-07-18) Three authorized PRs each add irreducible call-site wiring to ProviderDetailPageClient.tsx: cheaper-inference#7360 +5 (ProviderQuotaVisibilityToggle render), cheaper-inference#7419 +4 (NoAuthProviderControls wiring), cheaper-inference#7062 +3 (Dahl provider hook) = 786->798. All three follow the extracted-component pattern; the frozen file only takes the wiring. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

Resolves conflict in config/quality/file-size-baseline.json by keeping the consolidated R2/R3 merge-campaign rebaseline entry (786->798) that already accounts for this PR's NoAuthProviderControls wiring (+4), and resolves add/add conflict in src/lib/db/proxies/guards.ts by keeping this PR's hasBlockingProxyAssignment(connectionId, providerId?) signature. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

diegosouzapw · 2026-07-19T00:21:58Z

Merged into release/v3.8.49 — thank you for the contribution, @JxnLexn! 🎉 Validated in today's full-suite merge-train (33 PRs, 19k+ tests green) before landing.

* fix(theoldllm): honor provider proxy for Vercel blocks * fix(theoldllm): fail closed when assigned proxy is unavailable * refactor(theoldllm): extract proxy guards into dedicated module * fix(ui): expose provider proxy for no-auth providers * fix(proxy): preserve provider-specific no-auth proxy routing * fix(ui): hide unsupported proxy control for VeoAI Free * fix(proxy): handle no-auth provider proxy assignments safely * fix(dns): expose agent-specific host resolution * fix(ui): gate no-auth proxy controls by provider capability * chore(ci): restart GitHub checks * fix(proxy): pass provider to no-auth count tokens resolution * chore(quality): rebaseline ProviderDetailPageClient 786->798 (3-PR irreducible wiring, campaign 2026-07-18) Three authorized PRs each add irreducible call-site wiring to ProviderDetailPageClient.tsx: cheaper-inference#7360 +5 (ProviderQuotaVisibilityToggle render), cheaper-inference#7419 +4 (NoAuthProviderControls wiring), cheaper-inference#7062 +3 (Dahl provider hook) = 786->798. All three follow the extracted-component pattern; the frozen file only takes the wiring. Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com> --------- Co-authored-by: diegosouzapw <8016841+diegosouzapw@users.noreply.github.com>

fix(theoldllm): honor provider proxy for Vercel blocks

fe35154

JxnLexn requested a review from diegosouzapw as a code owner July 16, 2026 11:40

gemini-code-assist Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/app/(dashboard)/dashboard/providers/[id]/components/NoAuthProviderControls.tsx Resolved

Comment thread src/app/(dashboard)/dashboard/providers/[id]/components/NoAuthProviderControls.tsx Resolved

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

fix(theoldllm): fail closed when assigned proxy is unavailable

af422d4

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/app/(dashboard)/dashboard/providers/[id]/components/NoAuthProviderControls.tsx Resolved

refactor(theoldllm): extract proxy guards into dedicated module

676d399

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/sse/handlers/chatHelpers.ts Resolved

Comment thread src/app/(dashboard)/dashboard/providers/[id]/components/NoAuthProviderControls.tsx Resolved

chatgpt-codex-connector Bot reviewed Jul 16, 2026

View reviewed changes

Comment thread src/app/(dashboard)/dashboard/providers/[id]/components/NoAuthProviderControls.tsx Resolved

diegosouzapw mentioned this pull request Jul 17, 2026

fix(providers): honor provider proxies for a since-removed keyless provider's Vercel blocks #7380

Merged

diegosouzapw mentioned this pull request Jul 17, 2026

fix(rerank): apply per-connection proxy and strip top_n for Voyage AI #7420

Closed

7 of 8 tasks

JxnLexn added 8 commits July 17, 2026 22:52

fix(ui): expose provider proxy for no-auth providers

dbe4489

fix(proxy): preserve provider-specific no-auth proxy routing

b62e939

fix(ui): hide unsupported proxy control for VeoAI Free

acf2f8b

fix(proxy): handle no-auth provider proxy assignments safely

d155d8f

fix(dns): expose agent-specific host resolution

e7ad173

fix(ui): gate no-auth proxy controls by provider capability

f864f16

chore(ci): restart GitHub checks

5923b19

fix(proxy): pass provider to no-auth count tokens resolution

4198a1a

JxnLexn force-pushed the dev/fix-theoldllm-provider-proxy-ui branch from 709a726 to 4198a1a Compare July 17, 2026 20:53

chatgpt-codex-connector Bot reviewed Jul 17, 2026

View reviewed changes

Merge branch 'release/v3.8.49' into dev/fix-theoldllm-provider-proxy-ui

e0a9924

chatgpt-codex-connector Bot reviewed Jul 18, 2026

View reviewed changes

diegosouzapw mentioned this pull request Jul 18, 2026

fix(db): dedupe bulk-imported proxies by full credential tuple (#7594) #7644

Merged

diegosouzapw merged commit 53a6fea into cheaper-inference:release/v3.8.49 Jul 19, 2026
4 of 5 checks passed

diegosouzapw mentioned this pull request Jul 23, 2026

Release v3.8.49 #7076

Merged

cheaper-inference deleted a comment from chatgpt-codex-connector Bot Sep 7, 2026

Conversation

JxnLexn commented Jul 16, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Tests Added Or Updated

Coverage Notes

Reviewer Notes

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

Uh oh!

diegosouzapw commented Jul 17, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

JxnLexn commented Jul 17, 2026 • edited by diegosouzapw Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 17, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Jul 18, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

diegosouzapw commented Jul 19, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

JxnLexn commented Jul 16, 2026 •

edited

Loading

diegosouzapw commented Jul 17, 2026 •

edited

Loading

JxnLexn commented Jul 17, 2026 •

edited by diegosouzapw

Loading