Local proxy AI summaries fail with JWT 401 error via trymaple

[hyper-charlie]

Steps to reproduce

1. Set up trymaple.com desktop app for macOS (confirmed working)
2. Configure custom AI endpoint in Hyprnote: http://127.0.0.1:8080/v1
3. Set model to kimi-k2.5 (custom type doesn't support dropdown selection)
4. Attempt to generate AI summaries

Expected behavior

Hyprnote should successfully connect to the local proxy and generate summaries.

Actual behavior

Streaming fails with error:

Failed to create streaming completion: APl error: 401:{"status":401,"message":"Invalid JWT"}

Environment

• Platform: macOS
• OS Version: macOS 15.7.4 Sequoia
• App Version: 1.0.14
• Build: 57054b4
• Proxy: trymaple.com desktop app (confirmed working)
• Custom endpoint: http://127.0.0.1:8080/v1
• Model: kimi-k2.5

Notes

• User reports trymaple proxy is functioning correctly
• No specific API key appears to be required for local proxy operation
• Unable to copy error message directly from app (related to text selection issue)

[devin-ai-integration]

Codebase Analysis

Root Cause

The "Custom" LLM provider requires both base_url and api_key as mandatory fields. This means users must enter an API key to use the provider at all — but local proxies like trymaple don't need authentication.

Provider definition (apps/desktop/src/settings/ai/llm/shared.tsx:143-152):

{
  id: "custom",
  displayName: "Custom",
  baseUrl: undefined,
  requirements: [
    { kind: "requires_config", fields: ["base_url", "api_key"] },
  ],
},

The eligibility system (apps/desktop/src/settings/ai/shared/eligibility.ts:58-66) blocks provider selection if any required config field is empty/missing:

const missingFields = req.fields.filter((field) => {
  const value = context.config?.[field];
  return !value || value.trim() === "";
});

So the user must enter something in the API key field. That value then gets sent as Authorization: Bearer <value> in two places:

1. Model listing (apps/desktop/src/settings/ai/shared/list-openai.ts:78): listGenericModels sends Authorization: Bearer ${apiKey} when fetching /models.

2. Chat completions (apps/desktop/src/ai/hooks/useLLMConnection.ts:323-334): The default case in createLanguageModel passes apiKey to createOpenAICompatible, which sends it as a Bearer token on every request:

default: {
  const config = {
    fetch: tauriFetch,
    name: conn.providerId,
    baseURL: conn.baseUrl,
  };
  if (conn.apiKey) {
    config.apiKey = conn.apiKey;
  }
  const provider = createOpenAICompatible(config);
  return provider.chatModel(conn.modelId);
}

The trymaple proxy receives this Authorization: Bearer <dummy-value> header, attempts to validate it as a JWT, and returns 401: {"status":401,"message":"Invalid JWT"}.

Why "custom type doesn't support dropdown selection"

This is expected behavior — the model combobox for "custom" uses listGenericModels (apps/desktop/src/settings/ai/llm/select.tsx:290-291), which calls the proxy's /models endpoint with the same Bearer auth. If that also fails with 401, the model list comes back empty. The combobox does support freeform text entry (type a model name and click "Select"), but dropdown population requires a successful /models API call.

Relevant Files

File	Role
apps/desktop/src/settings/ai/llm/shared.tsx	Provider definitions & requirements
apps/desktop/src/settings/ai/shared/eligibility.ts	Eligibility/blocker logic
apps/desktop/src/ai/hooks/useLLMConnection.ts	Provider → LanguageModel creation
apps/desktop/src/settings/ai/shared/list-openai.ts	listGenericModels for custom provider
apps/desktop/src/settings/ai/shared/index.tsx	Provider settings form UI

Potential Approaches

1. Make api_key optional for the "custom" provider: Change requirements to fields: ["base_url"] only. In createLanguageModel, the default case already handles empty API keys gracefully (if (conn.apiKey) { config.apiKey = conn.apiKey; }), and listGenericModels would need a similar guard to skip the Authorization header when apiKey is empty.

2. Follow the Ollama/LM Studio pattern: These providers have requirements: [] (no mandatory config). The custom provider could similarly make both fields optional, showing them in an "Advanced" section or always visible but not required.

3. Add a "no auth" toggle: Add a UI option in the custom provider config to explicitly disable auth header injection for local proxies that don't need it.

Recent Changes

The relevant files (useLLMConnection.ts, shared.tsx, eligibility.ts) have had no functional changes recently — only formatting refactors (prettier -> oxfmt, dprint fmt) and the restructure from type-based to feature-based layout.