fix(providers): let a dashboard OFF for private provider URLs beat the env opt-in

[datrixlab]

Summary

• arePrivateProviderUrlsAllowed() opens with "DB override takes precedence — it represents an explicit user toggle in the dashboard", but it only acts on an override of "true". An override of "false" falls through to the process.env check.
• So with OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS=true in the environment (the opt-in .env.example describes), switching "Allow Private Provider URLs" OFF in the dashboard has no effect:
  • The provider validation and outbound guards stay at "none", which means no checks at all.
  • The Feature Flags page shows the flag as off, with source db.
• fix(#2575): check DB feature flag override in arePrivateProviderUrlsAllowed() #2595 (for [BUG] OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS feature flag dose nothing when running electron app. #2575) added the DB read to make the toggle work without a restart, and covered only the OFF→ON direction. The existing tests cover three of the four env/DB combinations and skip this one.
• Fix: read the stored override directly and treat any stored value as final for this flag. The sibling areLocalProviderUrlsAllowed() in the same file already does this (if (dbValue !== undefined && dbValue !== "") return isTrueValue(dbValue);).

env	DB override	before	after
true	none	allowed	allowed
unset	true	allowed	allowed
false	true	allowed	allowed
unset	false	blocked	blocked
true	false	allowed	blocked (getProviderValidationGuard() → block-metadata)

Related Issues

• Related to [BUG] OMNIROUTE_ALLOW_PRIVATE_PROVIDER_URLS feature flag dose nothing when running electron app. #2575 / fix(#2575): check DB feature flag override in arePrivateProviderUrlsAllowed() #2595 (the OFF→ON half of the same toggle)

Validation

• Change type: provider
• Focused tests: every unit test that imports outboundUrlGuardPolicy (feature-flag, local-flag, provider validation SSRF guard, provider models LAN guard, remote image fetch, webhook metadata / private opt-in, production build module integrity) plus cc-compatible-provider.test.ts: 63/63 pass
• eslint and prettier --check on the changed files
• Based on the current release/v3.8.51
• Production-code change includes a new automated test

Tests Added Or Updated

• tests/unit/outbound-url-guard-feature-flag.test.ts
  • DB override "false" with env "true" → not allowed, and the validation guard falls back to block-metadata.
  • Guard: DB override "false" does not change the legacy OUTBOUND_SSRF_GUARD_ENABLED=false hatch.
  • Guard: a DB override "false" for the sibling OMNIROUTE_ALLOW_LOCAL_PROVIDER_URLS still yields public-only. The existing local-flag tests only set that flag through process.env, so a DB-side regression there went unseen (its resolveFeatureFlag() call sits inside a try/catch that would swallow a failure).

With the source change reverted, the first test fails and the guards and the four existing tests pass.

Coverage Notes

• src/shared/network/outboundUrlGuardPolicy.ts: all four branches of the new override/env block are exercised by the seven tests in that file.

Reviewer Notes

• The legacy OUTBOUND_SSRF_GUARD_ENABLED=false hatch is intentionally left as it was. It is a different key, and whether a dashboard OFF for this flag should also override a globally disabled guard is a separate decision. Relatedly, the "SSRF Guard" flag (OUTBOUND_SSRF_GUARD_ENABLED) is only ever read from process.env here, so its own dashboard toggle does nothing. That one fails closed, so I left it out of this PR.
• The module now also imports getFeatureFlagOverride from @/lib/db/featureFlags. @/shared/utils/featureFlags already imported it, so the dependency graph is the same, and fix(providers): OpenCode Free models do not appear in Combo Builder on Windows #7682's CLI split is unaffected.

[diegosouzapw]

Confirmed and reproduced: arePrivateProviderUrlsAllowed() only ever acted on a DB override of
"true", so a dashboard OFF toggle silently did nothing when the env opt-in was set — exactly
the SSRF-adjacent gap you described, and important for the Electron build where the env value
is captured at boot. The fix correctly mirrors the sibling areLocalProviderUrlsAllowed()'s
existing pattern. All 7 tests (including the new DB-vs-env matrix and the sibling-flag
regression check) pass at the PR head. Ready to merge.