fix(settings): address Codex bot review round 2 on CPA auto-discovery

- Auto-discovery never sends the API key. The key is only transmitted
  on explicit user actions ("Test connection" button, Save). Removes
  implicit credential transmission to typo'd or untrusted endpoints
  during incremental baseUrl/wire edits.
- Move discovery status strings from `settings.providers.cliProxyApi.*`
  to `settings.providers.custom.*`. The modal renders these for every
  custom provider, not just CPA, so the copy must be provider-agnostic.
  Changed "Could not connect to CPA" → "Could not auto-discover models".

Signed-off-by: hqhq1025 <1506751656@qq.com>

Author: hqhq1025

apps/desktop/src/renderer/src/components/AddCustomProviderModal.tsx

@@ -110,26 +110,26 @@ export function AddCustomProviderModal({
   const debounceTimer = useRef<ReturnType<typeof setTimeout> | null>(null);
   const discoverySeq = useRef(0);
 
-  function scheduleDiscovery(currentBaseUrl: string, currentApiKey: string, currentWire: WireApi) {
+  function scheduleDiscovery(currentBaseUrl: string, currentWire: WireApi) {
     if (debounceTimer.current !== null) clearTimeout(debounceTimer.current);
     if (!currentBaseUrl.trim().match(/^https?:\/\//)) {
       setDiscovery({ kind: 'idle' });
       return;
     }
     debounceTimer.current = setTimeout(() => {
-      void runDiscovery(currentBaseUrl, currentApiKey, currentWire);
+      void runDiscovery(currentBaseUrl, currentWire);
     }, 500);
   }
 
-  async function runDiscovery(currentBaseUrl: string, currentApiKey: string, currentWire: WireApi) {
+  async function runDiscovery(currentBaseUrl: string, currentWire: WireApi) {
     if (!window.codesign?.config) return;
     const seq = ++discoverySeq.current;
     setDiscovery({ kind: 'discovering' });
     try {
       const res = await window.codesign.config.testEndpoint({
         wire: currentWire,
         baseUrl: currentBaseUrl.trim(),
-        apiKey: currentApiKey.trim(),
+        apiKey: '',
       });
       if (seq !== discoverySeq.current) return;
       if (res.ok && res.models.length > 0) {
@@ -150,7 +150,7 @@ export function AddCustomProviderModal({
     setBaseUrl(v);
     if (wireAuto) setWire(detectWireFromBaseUrl(v));
     setTest({ kind: 'idle' });
-    scheduleDiscovery(v, apiKey, wireAuto ? detectWireFromBaseUrl(v) : wire);
+    scheduleDiscovery(v, wireAuto ? detectWireFromBaseUrl(v) : wire);
   }
 
   function handleApiKeyChange(v: string) {
@@ -160,7 +160,7 @@ export function AddCustomProviderModal({
   function handleWireChange(v: WireApi) {
     setWire(v);
     setWireAuto(false);
-    scheduleDiscovery(baseUrl, apiKey, v);
+    scheduleDiscovery(baseUrl, v);
   }
 
   function handleModelSelect(v: string) {
@@ -348,19 +348,19 @@ export function AddCustomProviderModal({
             discovery.kind === 'discovering' ? (
               <span className="inline-flex items-center gap-1 text-[var(--text-xs)] text-[var(--color-text-muted)]">
                 <Loader2 className="w-3 h-3 animate-spin" />
-                {t('settings.providers.cliProxyApi.discoveringModels')}
+                {t('settings.providers.custom.discoveringModels')}
               </span>
             ) : discovery.kind === 'found' ? (
               <span className="inline-flex items-center gap-1 text-[var(--text-xs)] text-[var(--color-success)]">
                 <Check className="w-3 h-3" />
-                {t('settings.providers.cliProxyApi.discoveredModels', {
+                {t('settings.providers.custom.discoveredModels', {
                   count: discovery.models.length,
                 })}
               </span>
             ) : discovery.kind === 'failed' ? (
               <span className="inline-flex items-center gap-1 text-[var(--text-xs)] text-[var(--color-text-muted)]">
                 <AlertCircle className="w-3 h-3" />
-                {t('settings.providers.cliProxyApi.discoveryFailed')}
+                {t('settings.providers.custom.discoveryFailed')}
               </span>
             ) : null
           }

packages/i18n/src/locales/en.json

@@ -217,6 +217,9 @@
         "defaultModel": "Default model",
         "switchToManual": "Enter manually",
         "switchToDropdown": "Pick from list",
+        "discoveringModels": "Discovering models...",
+        "discoveredModels": "Found {{count}} models",
+        "discoveryFailed": "Could not auto-discover models",
         "test": "Test connection",
         "testOk": "OK — {{count}} models available",
         "save": "Save & continue",
@@ -307,10 +310,7 @@
         "presetName": "CLIProxyAPI",
         "presetDescription": "Local proxy that wraps Claude/Codex/Gemini OAuth subscriptions",
         "apiKeyOptional": "API key only required if you configured `api-keys` in CPA config.yaml",
-        "thinkingHint": "Tip: append `(high)` / `(xhigh)` / `(8192)` to model name to control thinking budget",
-        "discoveringModels": "Discovering models...",
-        "discoveredModels": "Found {{count}} models",
-        "discoveryFailed": "Could not connect to CPA"
+        "thinkingHint": "Tip: append `(high)` / `(xhigh)` / `(8192)` to model name to control thinking budget"
       },
       "reasoning": {
         "label": "Reasoning depth",

packages/i18n/src/locales/zh-CN.json

@@ -217,6 +217,9 @@
         "defaultModel": "默认模型",
         "switchToManual": "手动输入",
         "switchToDropdown": "从列表选择",
+        "discoveringModels": "正在发现模型…",
+        "discoveredModels": "发现 {{count}} 个模型",
+        "discoveryFailed": "无法自动发现模型",
         "test": "测试连接",
         "testOk": "正常 — 共 {{count}} 个模型",
         "save": "保存并继续",
@@ -307,10 +310,7 @@
         "presetName": "CLIProxyAPI",
         "presetDescription": "本地反代，将 Claude/Codex/Gemini 的订阅账号包装成统一 API",
         "apiKeyOptional": "仅当你在 CPA config.yaml 里配置了 api-keys 才需要填",
-        "thinkingHint": "提示：在 model 名后加 `(high)` / `(xhigh)` / `(8192)` 可控制思考力度",
-        "discoveringModels": "正在发现模型…",
-        "discoveredModels": "发现 {{count}} 个模型",
-        "discoveryFailed": "连接 CPA 失败"
+        "thinkingHint": "提示：在 model 名后加 `(high)` / `(xhigh)` / `(8192)` 可控制思考力度"
       },
       "reasoning": {
         "label": "推理深度",