🤐 fix: Withhold Custom Endpoint Headers for User URLs

[danny-avila]

Summary

I fixed the custom OpenAI-compatible endpoint path so configured secrets do not reach user-controlled custom endpoint URLs.

• Added a header-forwarding guard so getOpenAIConfig receives configured headers only for admin-trusted/static base URLs.
• Required user-stored API keys whenever a custom endpoint base URL is user-provided, preventing static configured API keys from being sent to user-controlled destinations.
• Applied the same user-key rule to model/token-config fetch resolution so fetchModels cannot send a static configured key to a user-provided base URL.
• Updated custom endpoint config metadata so URL-provided custom endpoints prompt users for an API key before the backend requires one.
• Added regression coverage for static Authorization, env-secret, {{LIBRECHAT_*}} placeholder headers, static API key withholding, model fetch behavior, native Anthropic custom endpoints, and endpoint credential prompts.

Change Type

• Bug fix (non-breaking change which fixes an issue)

Testing

• Ran npx jest src/endpoints/custom/config.spec.ts src/endpoints/custom/initialize.spec.ts src/endpoints/config/models.spec.ts --runInBand --coverage=false from packages/api
• Ran npx tsc --noEmit -p packages/api/tsconfig.json from the repo root
• Ran npm run build:api from the repo root
• Started the Codex review cycle and addressed both findings; latest Codex review found no major issues

Test Configuration:

• Node.js/Jest workspace dependencies installed locally with npm for this worktree

Checklist

• My code adheres to this project's style guidelines
• I have performed a self-review of my own code
• I have commented in any complex areas of my code
• My changes do not introduce new warnings
• I have written tests demonstrating that my changes are effective or that my feature works
• Local unit tests pass with my changes

[danny-avila]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 97d7a1434b

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

[danny-avila]

@codex review

[chatgpt-codex-connector]

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: f92b3a291c

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

[danny-avila]

@codex review

[chatgpt-codex-connector]

Codex Review: Didn't find any major issues. What shall we delve into next?

Reviewed commit: fbe630d9a3

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".