From 1f9a402dcd783daea168ac44f3611d2fc884d39c Mon Sep 17 00:00:00 2001
From: Regis <92858615+Regis-RCR@users.noreply.github.com>
Date: Mon, 16 Mar 2026 19:03:47 +0100
Subject: [PATCH] =?UTF-8?q?fix(sse):=20address=20bot=20review=20=E2=80=94?=
 =?UTF-8?q?=20tighten=20local=20detection,=20guard=20null=20model?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- Remove apiKey===null heuristic (too broad — could match cloud providers
  with non-standard auth). Use URL-based detection only.
- Guard local 404 branch with provider && model check — if either is null,
  fall through to standard connection lockout (safer behavior).
- Document LOCAL_HOSTNAMES as module-load-time constant (restart required).
- Document PROVIDER_PROFILES.local as intentionally not yet wired.
---
 open-sse/config/constants.ts        |  3 +++
 open-sse/config/providerRegistry.ts |  1 +
 src/sse/services/auth.ts            | 10 ++++------
 3 files changed, 8 insertions(+), 6 deletions(-)

diff --git a/open-sse/config/constants.ts b/open-sse/config/constants.ts
index ab2d154c91..9b4aeaf720 100644
--- a/open-sse/config/constants.ts
+++ b/open-sse/config/constants.ts
@@ -163,6 +163,9 @@ export const PROVIDER_PROFILES = {
     circuitBreakerThreshold: 5, // More tolerant (occasional 502 is normal)
     circuitBreakerReset: 30000, // 30s reset
   },
+  // Local providers (localhost inference backends like Ollama, LM Studio, oMLX).
+  // Not yet wired into getProviderProfile() — will be used when local provider_nodes
+  // are integrated into the resilience layer. Kept here to avoid a second constants change.
   local: {
     transientCooldown: 2000, // 2s (local — very fast recovery)
     rateLimitCooldown: 5000, // 5s (local — no real rate limits)
diff --git a/open-sse/config/providerRegistry.ts b/open-sse/config/providerRegistry.ts
index 579b0b9787..1ba3995987 100644
--- a/open-sse/config/providerRegistry.ts
+++ b/open-sse/config/providerRegistry.ts
@@ -1044,6 +1044,7 @@ export function generateAliasMap(): Record<string, string> {
 
 // ── Local Provider Detection ──────────────────────────────────────────────
 
+// Evaluated once at module load time — process restart required for env var changes.
 const LOCAL_HOSTNAMES = new Set([
   "localhost",
   "127.0.0.1",
diff --git a/src/sse/services/auth.ts b/src/sse/services/auth.ts
index 451d145cbb..d4f6ead196 100644
--- a/src/sse/services/auth.ts
+++ b/src/sse/services/auth.ts
@@ -566,17 +566,15 @@ export async function markAccountUnavailable(
     if (!shouldFallback) return { shouldFallback: false, cooldownMs: 0 };
 
     // ── Local provider 404: model-only lockout, connection stays active ──
+    // Detection: URL-based only (apiKey===null heuristic was too broad — could match
+    // cloud providers with non-standard auth stored in providerSpecificData).
     const connBaseUrl = (conn?.providerSpecificData as Record<string, unknown>)?.baseUrl as
       | string
       | undefined;
-    const isLocal =
-      isLocalProvider(connBaseUrl) || (conn?.apiKey === null && conn?.accessToken === null);
 
-    if (isLocal && status === 404) {
+    if (isLocalProvider(connBaseUrl) && status === 404 && provider && model) {
       const localCooldown = COOLDOWN_MS.notFoundLocal;
-      if (provider && model) {
-        lockModel(provider, connectionId, model, "local_not_found", localCooldown);
-      }
+      lockModel(provider, connectionId, model, "local_not_found", localCooldown);
       log.info(
         "AUTH",
         `Local 404 for ${model} — model-only lockout ${localCooldown / 1000}s (connection stays active)`