fix: usage script provider credential resolution (#1479)

The JS-script usage path resolved {{apiKey}}/{{baseUrl}} with env-only
field guessing, so apps that store credentials elsewhere (Codex:
auth.OPENAI_API_KEY + config.toml base_url) always got empty values and
custom-template queries failed despite a fully configured provider.

- query_usage / test_usage_script now delegate to
  Provider::resolve_usage_credentials, the same per-app resolver used by
  the native balance/coding-plan path and mirrored by the frontend
  getProviderCredentials; explicit non-empty script values still win
- test_usage_script loads the provider and applies the same fallback,
  so testing matches what a saved script does
- the custom-template variable preview shows the effective values
  (script overrides first, then provider config) instead of always
  showing provider credentials
- extract_codex_base_url documents and test-locks the frontend-mirror
  invariant: non-active [model_providers.*] sections are never read

Reworked from the original patch to reuse the existing resolver instead
of duplicating per-app extraction.

Co-authored-by: Jason <farion1231@gmail.com>

src-tauri/src/codex_config.rs

@@ -208,7 +208,10 @@ pub fn extract_codex_api_key(auth: Option<&Value>, config_text: Option<&str>) ->
 /// Extract the upstream base URL from a Codex `config.toml` string.
 ///
 /// Prefers the active `[model_providers.<model_provider>].base_url`, falling
-/// back to a top-level `base_url` when no model provider is selected.
+/// back to a top-level `base_url`. Deliberately never reads a non-active
+/// `[model_providers.*]` section — the frontend `extractCodexBaseUrl`
+/// (`getRecoverableBaseUrlAssignments`) excludes those too, and a leftover
+/// section unrelated to the active provider must not leak into `{{baseUrl}}`.
 pub fn extract_codex_base_url(config_text: &str) -> Option<String> {
     let doc = config_text.parse::<toml::Value>().ok()?;
 
@@ -1254,6 +1257,50 @@ mod tests {
     use super::*;
     use serde_json::json;
 
+    #[test]
+    fn extract_base_url_prefers_active_provider_section() {
+        let input = r#"model_provider = "azure"
+
+[model_providers.azure]
+base_url = "https://azure.example.com/v1"
+
+[model_providers.other]
+base_url = "https://other.example.com/v1"
+"#;
+
+        assert_eq!(
+            extract_codex_base_url(input).as_deref(),
+            Some("https://azure.example.com/v1")
+        );
+    }
+
+    #[test]
+    fn extract_base_url_falls_back_to_top_level_only() {
+        let top_level = r#"base_url = "https://top-level.example.com/v1""#;
+        assert_eq!(
+            extract_codex_base_url(top_level).as_deref(),
+            Some("https://top-level.example.com/v1")
+        );
+    }
+
+    // Mirrors the frontend extractCodexBaseUrl: a non-active provider section
+    // is never a credential source, whether the active provider points
+    // elsewhere (e.g. the built-in "openai") or none is selected at all.
+    #[test]
+    fn extract_base_url_ignores_non_active_provider_sections() {
+        let mismatched = r#"model_provider = "openai"
+
+[model_providers.custom]
+base_url = "https://leftover.example.com/v1"
+"#;
+        assert_eq!(extract_codex_base_url(mismatched), None);
+
+        let no_active = r#"[model_providers.any]
+base_url = "https://single.example.com/v1"
+"#;
+        assert_eq!(extract_codex_base_url(no_active), None);
+    }
+
     #[test]
     fn prepare_provider_live_config_rejects_key_without_config() {
         let err = prepare_codex_provider_live_config(&json!({"OPENAI_API_KEY": "sk-test"}), "")

src-tauri/src/provider.rs

@@ -108,17 +108,13 @@ impl Provider {
             .unwrap_or(false)
     }
 
-    /// Resolve `(base_url, api_key)` for native usage queries (balance /
-    /// coding-plan) from the stored provider config.
+    /// Resolve `(base_url, api_key)` for usage queries (native balance /
+    /// coding-plan and the JS-script `{{apiKey}}`/`{{baseUrl}}` fallback)
+    /// from the stored provider config.
     ///
     /// Each app persists credentials in a different shape, so callers must pass
     /// the owning app type. This mirrors the frontend `getProviderCredentials`
     /// in `UsageScriptModal.tsx`.
-    ///
-    /// TODO: the env-only helpers in `services/provider/usage.rs`
-    /// (`extract_api_key_from_provider` / `extract_base_url_from_provider`)
-    /// duplicate this per-app logic on the JS-script path and could delegate
-    /// here in a follow-up to remove the remaining copy.
     pub fn resolve_usage_credentials(
         &self,
         app_type: &crate::app_config::AppType,

src-tauri/src/services/provider/usage.rs

@@ -81,32 +81,33 @@ pub(crate) async fn execute_and_format_usage_result(
     }
 }
 
-/// Extract API key from provider configuration
-fn extract_api_key_from_provider(provider: &crate::provider::Provider) -> Option<String> {
-    if let Some(env) = provider.settings_config.get("env") {
-        // Try multiple possible API key fields
-        env.get("ANTHROPIC_AUTH_TOKEN")
-            .or_else(|| env.get("ANTHROPIC_API_KEY"))
-            .or_else(|| env.get("OPENROUTER_API_KEY"))
-            .or_else(|| env.get("GOOGLE_API_KEY"))
-            .and_then(|v| v.as_str())
-            .map(|s| s.to_string())
-    } else {
-        None
-    }
-}
+/// Resolve `(api_key, base_url)` for the JS-script path: explicit non-empty
+/// script values win, otherwise fall back to the provider's stored config via
+/// `Provider::resolve_usage_credentials` — the same per-app resolver the
+/// native balance/coding-plan path and the frontend `getProviderCredentials`
+/// use, so `{{apiKey}}`/`{{baseUrl}}` match what the UI shows for them.
+fn resolve_script_credentials(
+    app_type: &AppType,
+    provider: &crate::provider::Provider,
+    api_key: Option<&str>,
+    base_url: Option<&str>,
+) -> (String, String) {
+    let (provider_base_url, provider_api_key) = provider.resolve_usage_credentials(app_type);
 
-/// Extract base URL from provider configuration
-fn extract_base_url_from_provider(provider: &crate::provider::Provider) -> Option<String> {
-    if let Some(env) = provider.settings_config.get("env") {
-        // Try multiple possible base URL fields
-        env.get("ANTHROPIC_BASE_URL")
-            .or_else(|| env.get("GOOGLE_GEMINI_BASE_URL"))
-            .and_then(|v| v.as_str())
-            .map(|s| s.trim_end_matches('/').to_string())
-    } else {
-        None
-    }
+    let api_key = api_key
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        .map(str::to_owned)
+        .unwrap_or(provider_api_key);
+
+    let base_url = base_url
+        .map(str::trim)
+        .filter(|value| !value.is_empty())
+        // Trim like the provider path so `{{baseUrl}}/path` never doubles the slash.
+        .map(|value| value.trim_end_matches('/').to_owned())
+        .unwrap_or(provider_base_url);
+
+    (api_key, base_url)
 }
 
 /// Query provider usage (using saved script configuration)
@@ -145,19 +146,12 @@ pub async fn query_usage(
         }
 
         // Get credentials: prioritize UsageScript values, fallback to provider config
-        let api_key = usage_script
-            .api_key
-            .clone()
-            .filter(|k| !k.is_empty())
-            .or_else(|| extract_api_key_from_provider(provider))
-            .unwrap_or_default();
-
-        let base_url = usage_script
-            .base_url
-            .clone()
-            .filter(|u| !u.is_empty())
-            .or_else(|| extract_base_url_from_provider(provider))
-            .unwrap_or_default();
+        let (api_key, base_url) = resolve_script_credentials(
+            &app_type,
+            provider,
+            usage_script.api_key.as_deref(),
+            usage_script.base_url.as_deref(),
+        );
 
         (
             usage_script.code.clone(),
@@ -185,9 +179,9 @@ pub async fn query_usage(
 /// Test usage script (using temporary script content, not saved)
 #[allow(clippy::too_many_arguments)]
 pub async fn test_usage_script(
-    _state: &AppState,
-    _app_type: AppType,
-    _provider_id: &str,
+    state: &AppState,
+    app_type: AppType,
+    provider_id: &str,
     script_code: &str,
     timeout: u64,
     api_key: Option<&str>,
@@ -196,11 +190,23 @@ pub async fn test_usage_script(
     user_id: Option<&str>,
     template_type: Option<&str>,
 ) -> Result<UsageResult, AppError> {
-    // Use provided credential parameters directly for testing
+    let providers = state.db.get_all_providers(app_type.as_str())?;
+    let provider = providers.get(provider_id).ok_or_else(|| {
+        AppError::localized(
+            "provider.not_found",
+            format!("供应商不存在: {provider_id}"),
+            format!("Provider not found: {provider_id}"),
+        )
+    })?;
+
+    // Resolve like the real query so testing matches what a saved script does:
+    // explicit values win, empty ones fall back to the provider config.
+    let (api_key, base_url) = resolve_script_credentials(&app_type, provider, api_key, base_url);
+
     execute_and_format_usage_result(
         script_code,
-        api_key.unwrap_or(""),
-        base_url.unwrap_or(""),
+        &api_key,
+        &base_url,
         timeout,
         access_token,
         user_id,
@@ -226,3 +232,76 @@ pub(crate) fn validate_usage_script(script: &UsageScript) -> Result<(), AppError
 
     Ok(())
 }
+
+#[cfg(test)]
+mod tests {
+    use super::resolve_script_credentials;
+    use crate::app_config::AppType;
+    use crate::provider::Provider;
+    use serde_json::json;
+
+    fn provider_with_settings(settings_config: serde_json::Value) -> Provider {
+        Provider::with_id(
+            "provider-1".to_string(),
+            "Provider".to_string(),
+            settings_config,
+            None,
+        )
+    }
+
+    #[test]
+    fn script_values_override_provider_credentials() {
+        let provider = provider_with_settings(json!({
+            "env": {
+                "ANTHROPIC_AUTH_TOKEN": "provider-key",
+                "ANTHROPIC_BASE_URL": "https://provider.example.com/"
+            }
+        }));
+
+        let (api_key, base_url) = resolve_script_credentials(
+            &AppType::Claude,
+            &provider,
+            Some(" script-key "),
+            Some(" https://script.example.com/ "),
+        );
+        assert_eq!(api_key, "script-key");
+        assert_eq!(base_url, "https://script.example.com");
+    }
+
+    #[test]
+    fn empty_script_values_fall_back_to_provider_credentials() {
+        let provider = provider_with_settings(json!({
+            "env": {
+                "ANTHROPIC_AUTH_TOKEN": "provider-key",
+                "ANTHROPIC_BASE_URL": "https://provider.example.com/"
+            }
+        }));
+
+        let (api_key, base_url) =
+            resolve_script_credentials(&AppType::Claude, &provider, Some(""), None);
+        assert_eq!(api_key, "provider-key");
+        assert_eq!(base_url, "https://provider.example.com");
+    }
+
+    #[test]
+    fn codex_fallback_reads_auth_and_config_toml() {
+        let provider = provider_with_settings(json!({
+            "auth": {
+                "OPENAI_API_KEY": "openai-key"
+            },
+            "config": r#"model_provider = "azure"
+
+[model_providers.azure]
+base_url = "https://azure.example.com/v1/"
+
+[model_providers.other]
+base_url = "https://other.example.com/v1"
+"#
+        }));
+
+        let (api_key, base_url) =
+            resolve_script_credentials(&AppType::Codex, &provider, None, None);
+        assert_eq!(api_key, "openai-key");
+        assert_eq!(base_url, "https://azure.example.com/v1");
+    }
+}

src/components/UsageScriptModal.tsx

@@ -331,6 +331,14 @@ const UsageScriptModal: React.FC<UsageScriptModalProps> = ({
 
   const [testing, setTesting] = useState(false);
 
+  // {{apiKey}}/{{baseUrl}} 实际注入值，镜像后端 resolve_script_credentials 的
+  // 优先级：脚本配置中的显式非空值优先（旧配置可能携带），否则回退供应商凭据。
+  const effectiveScriptCredentials = {
+    apiKey: script.apiKey?.trim() || providerCredentials.apiKey,
+    baseUrl:
+      script.baseUrl?.trim().replace(/\/+$/, "") || providerCredentials.baseUrl,
+  };
+
   // 🔧 失焦时的验证（严格）- 仅确保有效整数
   const validateTimeout = (value: string): number => {
     const num = Number(value);
@@ -678,13 +686,12 @@ const UsageScriptModal: React.FC<UsageScriptModalProps> = ({
     const preset = PRESET_TEMPLATES[presetName];
     if (preset !== undefined) {
       if (presetName === TEMPLATE_TYPES.CUSTOM) {
-        // 🔧 自定义模式：用户应该在脚本中直接写完整 URL 和凭证，而不是依赖变量替换
-        // 这样可以避免同源检查导致的问题
-        // 如果用户想使用变量，需要手动在配置中设置 baseUrl/apiKey
+        // 自定义模板没有凭证输入框：清空显式覆盖值后，测试与真实查询
+        // 都会在后端回退到供应商配置（Provider::resolve_usage_credentials），
+        // 与下方“支持的变量”区域展示的 {{apiKey}}/{{baseUrl}} 取值一致。
         setScript({
           ...script,
           code: preset,
-          // 清除凭证，用户可选择手动输入或保持空
           apiKey: undefined,
           baseUrl: undefined,
           accessToken: undefined,
@@ -886,9 +893,9 @@ const UsageScriptModal: React.FC<UsageScriptModalProps> = ({
                       {"{{baseUrl}}"}
                     </code>
                     <span className="text-muted-foreground/50">=</span>
-                    {providerCredentials.baseUrl ? (
+                    {effectiveScriptCredentials.baseUrl ? (
                       <code className="text-foreground/70 break-all font-mono">
-                        {providerCredentials.baseUrl}
+                        {effectiveScriptCredentials.baseUrl}
                       </code>
                     ) : (
                       <span className="text-muted-foreground/50 italic">
@@ -903,11 +910,11 @@ const UsageScriptModal: React.FC<UsageScriptModalProps> = ({
                       {"{{apiKey}}"}
                     </code>
                     <span className="text-muted-foreground/50">=</span>
-                    {providerCredentials.apiKey ? (
+                    {effectiveScriptCredentials.apiKey ? (
                       <>
                         {showApiKey ? (
                           <code className="text-foreground/70 break-all font-mono">
-                            {providerCredentials.apiKey}
+                            {effectiveScriptCredentials.apiKey}
                           </code>
                         ) : (
                           <code className="text-foreground/70 font-mono">