Skip to content

fix: only show configured providers in model list - #1268

Closed
wtj-0527 wants to merge 4 commits into
nesquena:masterfrom
wtj-0527:fix/only-show-configured-providers-v2
Closed

wtj-0527 wants to merge 4 commits into
nesquena:masterfrom
wtj-0527:fix/only-show-configured-providers-v2

Conversation

@wtj-0527

Copy link
Copy Markdown

Problem

WebUI shows all hardcoded providers (OpenAI, Anthropic, Google, etc.)
even when they are not configured in config.yaml, giving users a false
impression that these providers are available.

Root Cause

get_available_models() in api/config.py auto-detects providers from
credential_pool and environment variables, then displays
models from _PROVIDER_MODELS for any detected provider, regardless
of whether the user actually configured them.

Solution

  1. Disable auto-detection from credential_pool (removed)
  2. Disable auto-detection from environment variables (removed)
  3. Only show providers that are explicitly configured in config.yaml
    • model.provider setting (active_provider)
    • providers section in config.yaml
  4. Keep live model fetching for custom provider with base_url configured
  5. Update model group building to only use configured providers

Testing

  • Before: /api/models shows OpenAI, Anthropic, Other groups with
    hardcoded models, even when not configured
  • After: /api/models only shows providers configured in config.yaml
    or the active_provider
  • Verified: Custom provider with base_url still works correctly
  • Principle: "only show what the user explicitly configured"

Related

KingBoyAndGirl added 2 commits April 30, 2026 01:08
Problem:
WebUI shows all hardcoded providers (OpenAI, Anthropic, Google, etc.)
even when they are not configured in config.yaml, giving users a false
impression that these providers are available.

Root Cause:
get_available_models() in api/config.py auto-detects providers from
auth_store, credential_pool, and environment variables, then displays
models from _PROVIDER_MODELS for any detected provider, regardless
of whether the user actually configured them.

Solution:
1. Disable auto-detection from credential_pool (removed)
2. Disable auto-detection from environment variables (removed)
3. Only show providers that are explicitly configured in config.yaml
   or the active_provider from model.provider setting
4. Keep live model fetching for custom provider with base_url configured
5. Update model group building to only use configured providers

Testing:
- Before: /api/models shows OpenAI, Anthropic, Other groups with
  hardcoded models, even when not configured
- After: /api/models only shows providers configured in config.yaml
  or the active_provider
- Verified that custom provider with base_url still works correctly
Add a new config option 'only_show_configured_providers' (default: false)
to control whether only configured providers are shown in the model list.

When set to true, only providers that are explicitly configured in
config.yaml (via model.provider or providers section) will be displayed.
This respects the principle: 'only show what the user configured'.

Detection logic for credential_pool and env vars is preserved to pass
existing tests. The filtering happens at display time.

Testing:
- Default behavior (false): show all detected providers (tests pass)
- When enabled (true): only show configured providers
@nesquena-hermes

Copy link
Copy Markdown
Collaborator

Thanks for the well-structured PR, @KingBoyAndGirl!

What this does: Filters the /api/models response so only providers explicitly configured in config.yaml (via model.provider or the providers section) appear in the model picker — eliminating the confusing "ghost" provider groups that show when credentials happen to be present in the environment.

On the two-commit evolution: The first commit removed auto-detection entirely; the second backed off to add a only_show_configured_providers config flag (default: false) so existing behaviour is preserved unless the user opts in. That's the right call — it avoids a silent breaking change for users who rely on env-var detection today.

A few things for maintainer review:

  • The flag name only_show_configured_providers is clear but slightly long. Consider providers.only_configured: true to keep it in a providers: namespace alongside future provider settings.
  • It's worth confirming the /api/models unit tests (or at least the snapshot of returned groups) still pass with both false (default) and true so CI catches regressions.
  • Related: issue Clarify and harden Provider/Model source-of-truth across WebUI, CLI, and Gateway #1240 tracks the broader provider source-of-truth work — this PR is a clean step in that direction.

Overall approach is sound. Leaving for maintainer sign-off on the flag naming and test coverage.

Per maintainer feedback on PR nesquena#1268:
- Move config from top-level only_show_configured_providers to
  providers.only_configured for better namespace organization
- This keeps provider-related settings grouped under providers: section
- Default behavior unchanged (false when not set)
@wtj-0527

Copy link
Copy Markdown
Author

Thanks for the suggestion! 🎉

I've updated the PR to follow the providers.only_configured naming as recommended:

  • Moved config from top-level only_show_configured_providers to providers.only_configured
  • This keeps provider-related settings properly namespaced
  • Default behavior unchanged (false when not set)

The latest commit has been pushed. Would you like me to add/update tests for both false (default) and true cases? Happy to do so if it helps with the merge. 😊

@nesquena-hermes

Copy link
Copy Markdown
Collaborator

Thanks for the quick update, @KingBoyAndGirl!

The rename to providers.only_configured is the right call — it keeps provider-related config properly namespaced and matches the pattern used elsewhere in the config structure.

On your question about tests: yes, adding explicit test cases for providers.only_configured: false (default behavior — all providers shown) and providers.only_configured: true (filtered to configured providers only) would be helpful before merge. The existing behavior is that unconfigured providers should still appear when the flag is not set, so a test confirming that default is preserved is worth having.

Everything else looks good.

Added TestOnlyConfiguredProviders class with 4 test cases:
- test_only_configured_false_shows_configured_providers
- test_only_configured_true_filters_to_configured
- test_only_configured_true_with_active_provider
- test_only_configured_default_is_false

Tests verify that the filtering behavior works correctly for both
True and False values of providers.only_configured config option.
@wtj-0527

Copy link
Copy Markdown
Author

Tests added! 🎉

I've added a new test class TestOnlyConfiguredProviders in tests/test_issue1106_custom_providers_models.py with 4 test cases:

test_only_configured_false_shows_configured_providers - Verifies configured providers appear when false
test_only_configured_true_filters_to_configured - Verifies only configured providers appear when true
test_only_configured_true_with_active_provider - Active provider always appears when true
test_only_configured_default_is_false - Backward compatibility check (default behavior)

All tests pass! 🚀

Latest commit: 1b71f13 - test: add test cases for providers.only_configured

Ready for review! 😊

@nesquena-hermes

Copy link
Copy Markdown
Collaborator

✅ Merged into release branch — included in PR #1285 (v0.50.240). Thanks for the contribution!

nesquena-hermes added a commit that referenced this pull request Apr 30, 2026
## Release v0.50.240

Batch release of 13 PRs that passed full triage + code review + test suite (3199 tests, 0 failures).

---

### Added

- **Compact tool activity mode** (`simplified_tool_calling`, default on) — groups tool calls and thinking traces into a single collapsed "Activity" disclosure card per assistant turn. Also adds a new **Calm Console** theme with earth/slate palette and serif prose. @Michaelyklam#1282
- **PDF first-page preview** — `MEDIA:` `.pdf` files render a canvas thumbnail via PDF.js CDN (4 MB cap). **HTML sandbox iframe** — `.html`/`.htm` files render inline in a sandboxed `<iframe srcdoc>` (256 KB cap). 10 i18n keys × 7 locales. @bergeouss#1280, closes #480 #482
- **Inline Excalidraw diagram preview** — `.excalidraw` files render as pure SVG (no external deps; rectangles, ellipses, diamonds, text, lines, arrows, freehand; 512 KB cap). @bergeouss#1279, closes #479
- **Inline CSV table rendering** — fenced `csv` blocks and `MEDIA:` CSV files render as scrollable HTML tables with auto-separator detection. @bergeouss#1277, closes #485
- **Inline SVG, audio, and video rendering** — SVG as `<img>`, audio as `<audio controls>`, video as `<video controls>`. @bergeouss#1276, closes #481
- **Batch session select mode** — multi-select sessions for bulk Archive/Delete/Move. 11 i18n keys × 7 locales. @bergeouss#1275, closes #568
- **Collapsible skill category headers** — click to collapse/expand without re-render; state persists across filter cycles. @bergeouss#1281
- **`providers.only_configured` setting** — opt-in flag to restrict the model picker to explicitly configured providers. @KingBoyAndGirl — #1268
- **OpenCode Go model catalog** — adds Kimi K2.6, DeepSeek V4 Pro/Flash, MiMo V2.5/Pro, Qwen3.6/3.5 Plus. @nesquena-hermes#1284, closes #1269

### Fixed

- **Profile `TERMINAL_CWD` TypeError** — `_build_agent_thread_env()` helper merges env before `_set_thread_env()` call. @hi-friday#1266
- **Service worker subpath cache bypass** — regex now matches `/api/*` under any mount prefix. @Michaelyklam#1278
- **SSE client disconnect leaks** — `TimeoutError`/`OSError` treated as clean disconnects; server backlog 64, threads daemonized; session list renders before saved-session restore. @KayZz69#1267
- **i18n locale corrections** — Korean MCP strings (23), Chinese MCP strings (23), zh-Hant missing keys (41), de missing keys (229). @bergeouss#1274, closes #1273

---

### Test results

```
3199 passed, 2 skipped, 3 xpassed in 72.79s
```

### PRs on hold (not included)

#1265 (draft), #1271 (superseded by #1266), #1272 (skipped XSS tests), #1232 (partial test run), #1222 (review questions open), #1134 (live-server tests), #1132 (superseded by #1134), #1108 (negative UX review), #1084 (empty description)
@nesquena-hermes

Copy link
Copy Markdown
Collaborator

Shipped in release v0.50.240 (PR #1285). Thanks!

SysAdminDoc pushed a commit to SysAdminDoc/hermes-webui that referenced this pull request Jun 26, 2026
## Release v0.50.240

Batch release of 13 PRs that passed full triage + code review + test suite (3199 tests, 0 failures).

---

### Added

- **Compact tool activity mode** (`simplified_tool_calling`, default on) — groups tool calls and thinking traces into a single collapsed "Activity" disclosure card per assistant turn. Also adds a new **Calm Console** theme with earth/slate palette and serif prose. @Michaelyklamnesquena#1282
- **PDF first-page preview** — `MEDIA:` `.pdf` files render a canvas thumbnail via PDF.js CDN (4 MB cap). **HTML sandbox iframe** — `.html`/`.htm` files render inline in a sandboxed `<iframe srcdoc>` (256 KB cap). 10 i18n keys × 7 locales. @bergeoussnesquena#1280, closes nesquena#480 nesquena#482
- **Inline Excalidraw diagram preview** — `.excalidraw` files render as pure SVG (no external deps; rectangles, ellipses, diamonds, text, lines, arrows, freehand; 512 KB cap). @bergeoussnesquena#1279, closes nesquena#479
- **Inline CSV table rendering** — fenced `csv` blocks and `MEDIA:` CSV files render as scrollable HTML tables with auto-separator detection. @bergeoussnesquena#1277, closes nesquena#485
- **Inline SVG, audio, and video rendering** — SVG as `<img>`, audio as `<audio controls>`, video as `<video controls>`. @bergeoussnesquena#1276, closes nesquena#481
- **Batch session select mode** — multi-select sessions for bulk Archive/Delete/Move. 11 i18n keys × 7 locales. @bergeoussnesquena#1275, closes nesquena#568
- **Collapsible skill category headers** — click to collapse/expand without re-render; state persists across filter cycles. @bergeoussnesquena#1281
- **`providers.only_configured` setting** — opt-in flag to restrict the model picker to explicitly configured providers. @KingBoyAndGirl — nesquena#1268
- **OpenCode Go model catalog** — adds Kimi K2.6, DeepSeek V4 Pro/Flash, MiMo V2.5/Pro, Qwen3.6/3.5 Plus. @nesquena-hermesnesquena#1284, closes nesquena#1269

### Fixed

- **Profile `TERMINAL_CWD` TypeError** — `_build_agent_thread_env()` helper merges env before `_set_thread_env()` call. @hi-fridaynesquena#1266
- **Service worker subpath cache bypass** — regex now matches `/api/*` under any mount prefix. @Michaelyklamnesquena#1278
- **SSE client disconnect leaks** — `TimeoutError`/`OSError` treated as clean disconnects; server backlog 64, threads daemonized; session list renders before saved-session restore. @KayZz69nesquena#1267
- **i18n locale corrections** — Korean MCP strings (23), Chinese MCP strings (23), zh-Hant missing keys (41), de missing keys (229). @bergeoussnesquena#1274, closes nesquena#1273

---

### Test results

```
3199 passed, 2 skipped, 3 xpassed in 72.79s
```

### PRs on hold (not included)

nesquena#1265 (draft), nesquena#1271 (superseded by nesquena#1266), nesquena#1272 (skipped XSS tests), nesquena#1232 (partial test run), nesquena#1222 (review questions open), nesquena#1134 (live-server tests), nesquena#1132 (superseded by nesquena#1134), nesquena#1108 (negative UX review), nesquena#1084 (empty description)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants