[AmintaCCCP]

Summary

Fixes #602.

When adding a local AI endpoint (e.g. Ollama on http://127.0.0.1:11434/v1 or a LAN model on http://192.168.x.x), clicking "Test connection" in the unsaved configuration form previously failed with a 502 Bad Gateway error (Blocked proxy request: hostname '127.0.0.1' is not allowed). However, once saved, the config worked normally because allowPrivate was conditionally set to Boolean(configId).

This PR sets allowPrivate = true for /api/proxy/ai, allowing users to test local and private network endpoints before saving, matching the behavior of the WebDAV proxy test endpoint.

Changes

1. Enable allowPrivate: true in /api/proxy/ai:

   • Both saved configurations (configId) and unsaved inline configurations (config) can now target localhost / 127.0.0.1 and private LAN endpoints over HTTP/HTTPS.
   • Cloud metadata IMDS protection (169.254.169.254, fd00:ec2::254, 0.0.0.0, ::) remains strictly enforced by ALWAYS_BLOCKED_RESOLVED_IPS.

2. Align docstrings in proxyService.ts:

   • Updated ValidateUrlOptions comment to reflect that both saved and test connection AI configs use lenient private endpoint access.

3. Unit Tests & Verification:

   • Added server/tests/routes/aiProxyRoute.test.ts to test inline local/LAN proxy requests, saved configs, and validation errors.
   • Verified directly against a live local Ollama instance on http://127.0.0.1:11434/v1 with HTTP 200 return.

Summary by CodeRabbit

• 功能改进
  • AI 代理现支持使用内联配置访问本地及私有网络地址，与已保存配置的行为保持一致。

[chatgpt-codex-connector]

Codex Review Summary: ❌ Failed

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	❌ Failed 2026-11-12T13:05:40.797135Z We couldn’t complete this review. Comment @codex review to try again.	cd0e348	PR opened

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[chatgpt-codex-connector]

You have reached your Codex usage limits for code reviews. You can see your limits in the Codex usage dashboard.

[coderabbitai]

No actionable comments were generated in the recent review.

Walkthrough

/api/proxy/ai 现在对内联配置和已保存配置都启用 allowPrivate。新增测试覆盖本地及 LAN 地址、已保存配置，以及缺少有效配置时的错误响应。

Changes: AI 代理内网地址访问

Layer / File(s)	Summary
路由行为与测试 server/src/routes/proxy.ts, server/src/services/proxyService.ts, server/tests/routes/aiProxyRoute.test.ts	/api/proxy/ai 对请求无条件启用 allowPrivate。相关注释调整了适用来源的描述。测试覆盖内联配置的本地及 LAN 地址、已保存配置，以及缺少有效配置时返回 400 和 CONFIG_ID_REQUIRED。

Estimated code review effort: 2 (Simple) | ~10 minutes

Change: Bug fix · Severity of issue fixed: Medium

Possibly related PRs

• AmintaCCCP/GithubStarsManager#497：该 PR 涉及相同的 allowPrivate 注释，回退后会恢复与本次路由行为不一致的说明。
• AmintaCCCP/GithubStarsManager#496：该 PR 将 allowPrivate 描述为仅适用于已保存配置，与本次对内联配置启用该选项的行为直接相关。

Merge Risk: Minimal · up to cd0e3

Testing an unsaved AI connection against localhost or LAN endpoints now behaves the same as for a saved one. Cloud metadata addresses stay blocked. No merge-blocking risk was identified.

Pre-merge checks: 4

Check name	Status	Explanation
Description Check		Check skipped - CodeRabbit’s high-level summary is enabled.
Title check		标题与变更内容一致。变更将 /api/proxy/ai 的 allowPrivate 设为 true，使已保存和未保存的内联 AI 配置都能访问本地或私有网络端点。标题描述了主要修复点（测试 AI 连接时允许本地和私有端点），且与 PR 目标和关联议题 #602 相符。标题中的 (#602) 是议题编号，不影响判断。
Linked Issues check		[#602] 需求：未保存的 AI 配置在“测试连接”时，应能访问本地或局域网端点（如 http://127.0.0.1:11434/v1），或明确提示需先保存。 证据：在 head 的 server/src/routes/proxy.ts 中，/api/proxy/ai 的 allowPrivate 从 Boolean(configId) 改为 true。因此内联 config 请求也使用宽松…
Out of Scope Changes check		本 PR 的变更均与 #602 相关。 - server/src/routes/proxy.ts：将 allowPrivate 设为 true，直接实现 #602 的修复目标。 - server/src/services/proxyService.ts：仅更新注释，使其与新的 AI 配置行为一致，属于支持性文档变更。 - server/tests/routes/aiProxyRoute.test…

Full details: Linked Issues check

Explanation

[#602] 需求：未保存的 AI 配置在“测试连接”时，应能访问本地或局域网端点（如 http://127.0.0.1:11434/v1），或明确提示需先保存。

证据：在 head 的 server/src/routes/proxy.ts 中，/api/proxy/ai 的 allowPrivate 从 Boolean(configId) 改为 true。因此内联 config 请求也使用宽松档，回环地址和私有网段不再被 proxyRequest 拒绝。这满足 #602 提出的第一种期望结果。

代码变更：server/src/services/proxyService.ts 仅更新 ValidateUrlOptions 的注释，不改变逻辑。ALWAYS_BLOCKED_RESOLVED_IPS 的元数据地址封锁保持不变。

测试：新增 server/tests/routes/aiProxyRoute.test.ts，覆盖未保存的 127.0.0.1 内联配置、内网内联配置、configId 已保存配置，并断言 allowPrivate 为 true。缺少 configId 且无有效内联配置时返回 400 和 CONFIG_ID_REQUIRED。

未验证项：本次未检查路由是否要求 API_SECRET 认证。Issue 建议的一种缓解方案是仅对已认证请求放宽。PR 对所有请求放宽，这是设计选择，不是 #602 的明确编码要求。

Full details: Out of Scope Changes check

Explanation

本 PR 的变更均与 #602 相关。

• server/src/routes/proxy.ts：将 allowPrivate 设为 true，直接实现 #602 的修复目标。
• server/src/services/proxyService.ts：仅更新注释，使其与新的 AI 配置行为一致，属于支持性文档变更。
• server/tests/routes/aiProxyRoute.test.ts：新增测试，直接验证内联和已保存配置的行为，属于支持性测试变更。

未发现与 #602 无关的功能改动。

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

Share

• X
• Mastodon
• Reddit
• LinkedIn

Recent review info

Run configuration

• Source mode: Auto
• Repository: Unavailable
• Branch: Unavailable
• File: No configuration file from this repository applied
• Commit: Unavailable
• Layers: Organization UI
• Review profile: CHILL
• Plan: Advanced
• Run ID: 67af48c3-a351-44e2-b372-2ac50123b572

Commits

Reviewing files that changed from the base of the PR and between 6b895ac and cd0e348.

Files selected for processing: 3

• server/src/routes/proxy.ts
• server/src/services/proxyService.ts
• server/tests/routes/aiProxyRoute.test.ts

Included review availability: This review used your included allowance. Your plan provides up to 8 included reviews per hour; 6 remain after this review.