fix(workspace-server): inject <PROVIDER>_BASE_URL fallback when API key is set but URL missing (internal#417)

When the operator saves only a vendor API key (e.g. MINIMAX_API_KEY)
into global_secrets without the matching <PROVIDER>_BASE_URL, the
in-workspace adapter falls back to its hardcoded registry default —
which for MiniMax is api.minimaxi.com (China region), while every
operator-host key in the post-2026-05-06 stack is issued against
api.minimax.io (global region). The result is silent 401 on every
LLM call from the workspace.

Fix: in workspace-server/internal/handlers/workspace_provision.go's
loadWorkspaceSecrets, after both DB queries, run a fallback pass that
injects the canonical <PROVIDER>_BASE_URL for every vendor whose API
key is set but whose URL is absent. Operator-saved URLs always win
(no overwrite); empty keys are treated as unset (no injection).

The canonical URL registry lives in
workspace-server/internal/handlers/provider_defaults.go and mirrors
the third-party provider lists in workspace-configs-templates/
openclaw + claude-code-default + hermes adapters. Six providers
covered (openai, groq, openrouter, qianfan, minimax, moonshot).

Also seed MINIMAX_API_KEY + MINIMAX_BASE_URL into the dev-local
post-rebuild-setup.sh global_secrets block so dev parity matches
prod-style provisioning.

Co-Authored-By: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

scripts/post-rebuild-setup.sh

@@ -41,6 +41,13 @@ until curl -s --max-time 5 "$PLATFORM_URL/health" >/dev/null 2>&1; do
 done
 echo "  platform up"
 
+# MINIMAX_BASE_URL defaults to the global endpoint (api.minimax.io) —
+# matches the operator-host MINIMAX_API_KEY scope. Override by setting
+# MINIMAX_BASE_URL before running this script (e.g. for the China
+# endpoint api.minimaxi.com). See RFC internal#417 for why the global
+# URL is the safe default.
+: "${MINIMAX_BASE_URL:=https://api.minimax.io}"
+
 echo "=== Inserting global secrets ==="
 docker exec "$DB_CONTAINER" psql -U "$DB_USER" -d "$DB_NAME" -c "
 INSERT INTO global_secrets (key, encrypted_value, encryption_version) VALUES
@@ -50,10 +57,12 @@ INSERT INTO global_secrets (key, encrypted_value, encryption_version) VALUES
 ('ANTHROPIC_SMALL_FAST_MODEL', 'MiniMax-M2.7', 0),
 ('API_TIMEOUT_MS', '3000000', 0),
 ('CLAUDE_CODE_DISABLE_NONESSENTIAL_TRAFFIC', '1', 0),
-('GITHUB_TOKEN', '$GITHUB_PAT', 0)
+('GITHUB_TOKEN', '$GITHUB_PAT', 0),
+('MINIMAX_API_KEY', '$MINIMAX_API_KEY', 0),
+('MINIMAX_BASE_URL', '$MINIMAX_BASE_URL', 0)
 ON CONFLICT (key) DO UPDATE SET encrypted_value = EXCLUDED.encrypted_value;
 "
-echo "  7 global secrets set"
+echo "  9 global secrets set"
 
 echo "=== Importing org template ==="
 curl -s --max-time 600 -X POST "$PLATFORM_URL/org/import" \

workspace-server/internal/handlers/a2a_queue_status_handler_test.go

@@ -1,408 +0,0 @@
-package handlers
-
-import (
-	"database/sql"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/gin-gonic/gin"
-)
-
-// setupQueueStatusHandlerDB creates a sqlmock DB with QueryMatcherEqual for exact SQL string matching.
-func setupQueueStatusHandlerDB(t *testing.T) sqlmock.Sqlmock {
-	t.Helper()
-	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-	if err != nil {
-		t.Fatalf("sqlmock.New: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-	return mock
-}
-
-// Exact SQL strings used by the production code.
-const (
-	sqlQueueRowAuthFields = `SELECT caller_id, workspace_id FROM a2a_queue WHERE id = $1`
-	sqlQueueStatusByID    = `
-		SELECT
-			q.id,
-			q.workspace_id,
-			q.status,
-			q.priority,
-			q.attempts,
-			q.last_error,
-			q.enqueued_at::text,
-			q.dispatched_at::text,
-			q.completed_at::text,
-			q.expires_at::text,
-			al.response_body::text
-		FROM a2a_queue q
-		LEFT JOIN activity_logs al
-			ON al.method = 'delegate_result'
-			AND al.target_id = q.workspace_id
-			AND al.workspace_id = q.caller_id
-			AND al.response_body->>'delegation_id' = (q.body->'params'->'message'->'metadata'->>'delegation_id')
-		WHERE q.id = $1`
-)
-
-// ── GetA2AQueueStatus HTTP handler tests ──────────────────────────────────────
-
-// TestGetA2AQueueStatus_QueueIDEmpty_Returns400 exercises the handler directly
-// (not via router) so we can verify the empty-value branch without relying on
-// Gin route-matching behaviour.
-func TestGetA2AQueueStatus_QueueIDEmpty_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"}}
-	// queue_id param is empty string
-	c.Params = gin.Params{
-		{Key: "id", Value: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"},
-		{Key: "queue_id", Value: ""},
-	}
-	c.Request = httptest.NewRequest(http.MethodGet, "/", nil)
-
-	h.GetA2AQueueStatus(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400", w.Code)
-	}
-}
-
-func TestGetA2AQueueStatus_NoIdentity_NoOrgToken_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/wsid/a2a/queue/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa", nil)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	// No identity derivable → 404 (not 401) per existence-non-inference policy.
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404", w.Code)
-	}
-}
-
-func TestGetA2AQueueStatus_OrgToken_SkipsCallerCheck(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow("other-ws", wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	statusRows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "queued", 50, 0,
-		nil, "2026-01-01T00:00:00Z", nil, nil, nil, nil,
-	)
-	mock.ExpectQuery(sqlQueueStatusByID).
-		WithArgs(queueID).
-		WillReturnRows(statusRows)
-
-	r := gin.New()
-	// Simulate org-token middleware setting org_token_id.
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", func(c *gin.Context) {
-		c.Set("org_token_id", "org-admin")
-		h.GetA2AQueueStatus(c)
-	})
-
-	req := httptest.NewRequest(http.MethodGet, "/workspaces/wsid/a2a/queue/"+queueID, nil)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_CallerWorkspaceMatchesCallerID_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	statusRows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "completed", 50, 1,
-		nil, "2026-01-01T00:00:00Z", "2026-01-01T00:01:00Z", "2026-01-01T00:02:00Z",
-		nil, []byte(`{"text":"result"}`),
-	)
-	mock.ExpectQuery(sqlQueueStatusByID).
-		WithArgs(queueID).
-		WillReturnRows(statusRows)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", callerID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_CallerWorkspaceMatchesWorkspaceID_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	statusRows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "queued", 50, 0,
-		nil, "2026-01-01T00:00:00Z", nil, nil, nil, nil,
-	)
-	mock.ExpectQuery(sqlQueueStatusByID).
-		WithArgs(queueID).
-		WillReturnRows(statusRows)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", wsID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_QueueNotFound_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrNoRows)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", callerID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_QueueAuthFieldsDBError_Returns500(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrConnDone)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", callerID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("got %d, want 500: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_WrongCallerWorkspace_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-	wrongCaller := "dddddddd-dddd-dddd-dddd-dddddddddddd"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", wrongCaller)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_StatusFetchDBError_Returns500(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	mock.ExpectQuery(sqlQueueStatusByID).
-		WithArgs(queueID).
-		WillReturnError(sql.ErrConnDone)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", callerID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("got %d, want 500: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestGetA2AQueueStatus_FullHappyPath_ReturnsJSON(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupQueueStatusHandlerDB(t)
-	h := &WorkspaceHandler{}
-
-	queueID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	callerID := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	wsID := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	authRows := sqlmock.NewRows([]string{"caller_id", "workspace_id"}).
-		AddRow(callerID, wsID)
-	mock.ExpectQuery(sqlQueueRowAuthFields).
-		WithArgs(queueID).
-		WillReturnRows(authRows)
-
-	respBody := []byte(`{"text":"delegation result"}`)
-	statusRows := sqlmock.NewRows([]string{
-		"id", "workspace_id", "status", "priority", "attempts",
-		"last_error", "enqueued_at", "dispatched_at", "completed_at", "expires_at",
-		"response_body",
-	}).AddRow(
-		queueID, wsID, "completed", 50, 1,
-		nil, "2026-01-01T00:00:00Z", "2026-01-01T00:01:00Z", "2026-01-01T00:02:00Z",
-		nil, respBody,
-	)
-	mock.ExpectQuery(sqlQueueStatusByID).
-		WithArgs(queueID).
-		WillReturnRows(statusRows)
-
-	r := gin.New()
-	r.GET("/workspaces/:id/a2a/queue/:queue_id", h.GetA2AQueueStatus)
-
-	req := httptest.NewRequest(http.MethodGet,
-		"/workspaces/"+wsID+"/a2a/queue/"+queueID, nil)
-	req.Header.Set("X-Workspace-ID", wsID)
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if w.Body.Len() == 0 {
-		t.Error("response body is empty")
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}

workspace-server/internal/handlers/provider_defaults.go

@@ -0,0 +1,97 @@
+package handlers
+
+// Mirror of the third-party LLM provider registry baked into adapter
+// templates (workspace-configs-templates/openclaw/adapter.py +
+// workspace-configs-templates/claude-code-default/adapter.py + the
+// hermes counterparts). Must stay in sync — if a provider is added in
+// any of those adapters' base_url defaults, add it here too.
+//
+// Why this exists (RFC internal#417):
+//
+// Operators saving a vendor-scoped API key (e.g. MINIMAX_API_KEY) into
+// the platform `global_secrets` table expect the workspace to talk to
+// the canonical regional endpoint for that key. Pre-fix, when no
+// matching <PROVIDER>_BASE_URL was also saved, the adapter inside the
+// workspace fell back to its hardcoded registry default — which for
+// MiniMax is api.minimaxi.com (China), while every operator key issued
+// against api.minimax.io (global) hits 401 there. The fix is platform-
+// side: when we see the API key but no URL, we inject the canonical URL
+// so the workspace's adapter precedence chain (operator URL > runtime
+// config > adapter default) ends up pointing at the right region.
+//
+// This is a FALLBACK, never an override. If the operator already
+// saved <PROVIDER>_BASE_URL we leave it alone; their explicit choice
+// always wins. If the API key isn't set, we don't inject a stray URL
+// for a provider the workspace never uses.
+//
+// MINIMAX_BASE_URL is set to api.minimax.io (NOT api.minimaxi.com) —
+// the global endpoint matches the keys all operator-host secrets are
+// issued against. See RFC internal#417 §Phase 1 for the regional
+// ambiguity table.
+var ProviderBaseURLDefaults = map[string]string{
+	"OPENAI_BASE_URL":     "https://api.openai.com/v1",
+	"GROQ_BASE_URL":       "https://api.groq.com/openai/v1",
+	"OPENROUTER_BASE_URL": "https://openrouter.ai/api/v1",
+	"QIANFAN_BASE_URL":    "https://qianfan.baidubce.com/v2",
+	"MINIMAX_BASE_URL":    "https://api.minimax.io",
+	"MOONSHOT_BASE_URL":   "https://api.moonshot.ai/v1",
+}
+
+// applyProviderBaseURLDefaults injects each provider's canonical
+// BASE_URL into envVars when the matching <PROVIDER>_API_KEY is set
+// and non-empty AND no <PROVIDER>_BASE_URL is already present.
+//
+// The function mutates envVars in place. It is a pure helper (no DB,
+// no I/O) so unit tests drive it directly without sqlmock.
+//
+// Pairing rule: each entry in ProviderBaseURLDefaults names a key of
+// the form <PREFIX>_BASE_URL; the paired API-key var is derived by
+// swapping the suffix to _API_KEY (e.g. MINIMAX_BASE_URL ↔
+// MINIMAX_API_KEY). This mirrors how every adapter registry pairs the
+// two — see workspace-configs-templates/*/adapter.py for the canonical
+// pairing and RFC internal#417 §Phase 2 for the design rationale.
+//
+// Returns the list of base-URL keys that were injected, so the caller
+// can log which fallbacks fired without re-iterating the map.
+func applyProviderBaseURLDefaults(envVars map[string]string) []string {
+	if envVars == nil {
+		return nil
+	}
+	var injected []string
+	for baseURLKey, defaultURL := range ProviderBaseURLDefaults {
+		// Derive the paired API-key var name. Every entry in the map
+		// MUST end in `_BASE_URL`; if a future entry breaks that
+		// convention this strip-and-swap silently misses it. The unit
+		// test TestApplyProviderBaseURLDefaults_KeyShape pins the
+		// shape so the miss surfaces immediately on next test run.
+		const baseSuffix = "_BASE_URL"
+		if len(baseURLKey) <= len(baseSuffix) ||
+			baseURLKey[len(baseURLKey)-len(baseSuffix):] != baseSuffix {
+			continue
+		}
+		apiKeyKey := baseURLKey[:len(baseURLKey)-len(baseSuffix)] + "_API_KEY"
+
+		// API key must be present AND non-empty. An empty string is
+		// treated as unset — operators sometimes save a placeholder
+		// row and we don't want to silently route them to a real
+		// endpoint with no credential.
+		apiKeyVal, hasKey := envVars[apiKeyKey]
+		if !hasKey || apiKeyVal == "" {
+			continue
+		}
+
+		// Don't overwrite an explicit operator URL. The operator may
+		// have legitimately scoped this provider to a custom or
+		// regional endpoint (e.g. a corporate proxy, a different
+		// MiniMax region). Their explicit value always wins — same
+		// precedence rule as molecule_runtime.adapter_base's
+		// resolve_provider_routing.
+		if existing, ok := envVars[baseURLKey]; ok && existing != "" {
+			continue
+		}
+
+		envVars[baseURLKey] = defaultURL
+		injected = append(injected, baseURLKey)
+	}
+	return injected
+}

workspace-server/internal/handlers/provider_defaults_test.go

@@ -0,0 +1,118 @@
+package handlers
+
+import (
+	"strings"
+	"testing"
+)
+
+// TestApplyProviderBaseURLDefaults_InjectsWhenKeySetAndURLAbsent — the
+// happy path that closes RFC internal#417's reported bug: operator
+// saves MINIMAX_API_KEY only, fallback fills in the canonical URL.
+func TestApplyProviderBaseURLDefaults_InjectsWhenKeySetAndURLAbsent(t *testing.T) {
+	envVars := map[string]string{
+		"MINIMAX_API_KEY": "sk-real-key",
+	}
+
+	injected := applyProviderBaseURLDefaults(envVars)
+
+	if got := envVars["MINIMAX_BASE_URL"]; got != "https://api.minimax.io" {
+		t.Fatalf("MINIMAX_BASE_URL: got %q, want %q", got, "https://api.minimax.io")
+	}
+	if len(injected) != 1 || injected[0] != "MINIMAX_BASE_URL" {
+		t.Fatalf("injected list: got %v, want [MINIMAX_BASE_URL]", injected)
+	}
+}
+
+// TestApplyProviderBaseURLDefaults_DoesNotOverrideExplicitURL — operator
+// override wins. If they saved both MINIMAX_API_KEY and a custom URL
+// (say a corporate-proxy or a different region), we leave their URL
+// alone. This is the precedence rule from RFC §Phase 2.
+func TestApplyProviderBaseURLDefaults_DoesNotOverrideExplicitURL(t *testing.T) {
+	envVars := map[string]string{
+		"MINIMAX_API_KEY":  "sk-real-key",
+		"MINIMAX_BASE_URL": "https://custom.example.com",
+	}
+
+	injected := applyProviderBaseURLDefaults(envVars)
+
+	if got := envVars["MINIMAX_BASE_URL"]; got != "https://custom.example.com" {
+		t.Fatalf("MINIMAX_BASE_URL: got %q, want operator value %q",
+			got, "https://custom.example.com")
+	}
+	for _, k := range injected {
+		if k == "MINIMAX_BASE_URL" {
+			t.Fatalf("MINIMAX_BASE_URL should not appear in injected list when operator set it explicitly; got %v", injected)
+		}
+	}
+}
+
+// TestApplyProviderBaseURLDefaults_NoKeyNoInjection — provider whose
+// API key isn't set should not get a stray URL injected. Keeps the
+// workspace env clean and avoids accidentally signalling that the
+// provider is available when it isn't.
+func TestApplyProviderBaseURLDefaults_NoKeyNoInjection(t *testing.T) {
+	envVars := map[string]string{
+		// Some unrelated key set, but no MINIMAX_API_KEY.
+		"OPENAI_API_KEY": "sk-openai",
+	}
+
+	injected := applyProviderBaseURLDefaults(envVars)
+
+	if _, ok := envVars["MINIMAX_BASE_URL"]; ok {
+		t.Fatalf("MINIMAX_BASE_URL was injected without MINIMAX_API_KEY being set; envVars=%v", envVars)
+	}
+	// OPENAI_API_KEY is set, so OPENAI_BASE_URL should be injected —
+	// keeps this test honest about what "no injection" means (it's
+	// per-provider, not blanket).
+	if envVars["OPENAI_BASE_URL"] != "https://api.openai.com/v1" {
+		t.Fatalf("OPENAI_BASE_URL: got %q, want %q",
+			envVars["OPENAI_BASE_URL"], "https://api.openai.com/v1")
+	}
+	for _, k := range injected {
+		if k == "MINIMAX_BASE_URL" {
+			t.Fatalf("MINIMAX_BASE_URL should not appear in injected list; got %v", injected)
+		}
+	}
+}
+
+// TestApplyProviderBaseURLDefaults_EmptyKeyTreatedAsUnset — operators
+// sometimes save a placeholder empty-string row (e.g. they cleared the
+// key but didn't delete the row). Treat that the same as the key being
+// absent: don't route to a real endpoint with no credential.
+func TestApplyProviderBaseURLDefaults_EmptyKeyTreatedAsUnset(t *testing.T) {
+	envVars := map[string]string{
+		"MINIMAX_API_KEY": "", // explicitly empty
+	}
+
+	injected := applyProviderBaseURLDefaults(envVars)
+
+	if _, ok := envVars["MINIMAX_BASE_URL"]; ok {
+		t.Fatalf("MINIMAX_BASE_URL should not be injected when MINIMAX_API_KEY=\"\"; envVars=%v", envVars)
+	}
+	if len(injected) != 0 {
+		t.Fatalf("injected list should be empty when key is empty; got %v", injected)
+	}
+}
+
+// TestApplyProviderBaseURLDefaults_KeyShape — every key in the
+// registry must end in `_BASE_URL` so the strip-and-swap in
+// applyProviderBaseURLDefaults can derive the paired API-key var
+// name. If a future entry breaks that convention the fallback
+// silently misses it; this test catches the drift at next CI run.
+func TestApplyProviderBaseURLDefaults_KeyShape(t *testing.T) {
+	for k := range ProviderBaseURLDefaults {
+		if !strings.HasSuffix(k, "_BASE_URL") {
+			t.Errorf("ProviderBaseURLDefaults key %q must end in _BASE_URL", k)
+		}
+	}
+}
+
+// TestApplyProviderBaseURLDefaults_NilMap — defensive: the helper is
+// called from loadWorkspaceSecrets right before return, after both
+// query loops. If a future refactor passes nil (e.g. an error path
+// returns the bare nil map literal), the helper must not panic. The
+// function's nil-guard pins this.
+func TestApplyProviderBaseURLDefaults_NilMap(t *testing.T) {
+	// Must not panic. Return value can be nil/empty either way.
+	_ = applyProviderBaseURLDefaults(nil)
+}

workspace-server/internal/handlers/workspace_abilities_test.go

@@ -1,317 +0,0 @@
-package handlers
-
-import (
-	"database/sql"
-	"net/http"
-	"net/http/httptest"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/gin-gonic/gin"
-)
-
-// setupAbilitiesDB creates a sqlmock DB with QueryMatcherEqual for exact SQL matching.
-func setupAbilitiesDB(t *testing.T) sqlmock.Sqlmock {
-	t.Helper()
-	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-	if err != nil {
-		t.Fatalf("sqlmock.New: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-	return mock
-}
-
-// Exact SQL strings used by the production handler.
-const (
-	sqlPatchAbilitiesExists = `SELECT EXISTS(SELECT 1 FROM workspaces WHERE id = $1 AND status != 'removed')`
-	sqlPatchBroadcastEnabled   = `UPDATE workspaces SET broadcast_enabled = $2, updated_at = now() WHERE id = $1`
-	sqlPatchTalkToUserEnabled  = `UPDATE workspaces SET talk_to_user_enabled = $2, updated_at = now() WHERE id = $1`
-)
-
-// ── PatchAbilities HTTP handler tests ──────────────────────────────────────────
-
-func TestPatchAbilities_InvalidWorkspaceID_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupAbilitiesDB(t)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "not-a-uuid"}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/not-a-uuid/abilities", nil)
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400", w.Code)
-	}
-}
-
-func TestPatchAbilities_InvalidBody_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupAbilitiesDB(t)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"}}
-	c.Request = httptest.NewRequest(http.MethodPatch,
-		"/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/abilities",
-		newFakeCloser([]byte("not json")))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400", w.Code)
-	}
-}
-
-func TestPatchAbilities_NoAbilityFields_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupAbilitiesDB(t)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"}}
-	c.Request = httptest.NewRequest(http.MethodPatch,
-		"/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/abilities",
-		newFakeCloser([]byte(`{}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400", w.Code)
-	}
-}
-
-func TestPatchAbilities_WorkspaceNotFound_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnError(sql.ErrNoRows)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"broadcast_enabled":true}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_WorkspaceNotFound_ExistsFalse_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(false))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"talk_to_user_enabled":false}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_UpdateBroadcastEnabled_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
-
-	mock.ExpectExec(sqlPatchBroadcastEnabled).
-		WithArgs(wsID, true).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"broadcast_enabled":true}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_UpdateTalkToUserEnabled_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
-
-	mock.ExpectExec(sqlPatchTalkToUserEnabled).
-		WithArgs(wsID, false).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"talk_to_user_enabled":false}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_UpdateBothAbilities_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
-
-	mock.ExpectExec(sqlPatchBroadcastEnabled).
-		WithArgs(wsID, true).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	mock.ExpectExec(sqlPatchTalkToUserEnabled).
-		WithArgs(wsID, false).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"broadcast_enabled":true,"talk_to_user_enabled":false}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_BroadcastEnabledDBError_Returns500(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
-
-	mock.ExpectExec(sqlPatchBroadcastEnabled).
-		WithArgs(wsID, true).
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"broadcast_enabled":true}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("got %d, want 500: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestPatchAbilities_TalkToUserEnabledDBError_Returns500(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupAbilitiesDB(t)
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlPatchAbilitiesExists).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"exists"}).AddRow(true))
-
-	mock.ExpectExec(sqlPatchTalkToUserEnabled).
-		WithArgs(wsID, true).
-		WillReturnError(sql.ErrConnDone)
-
-	w := httptest.NewRecorder()
-	c, _ := gin.CreateTestContext(w)
-	c.Params = gin.Params{{Key: "id", Value: wsID}}
-	c.Request = httptest.NewRequest(http.MethodPatch, "/workspaces/"+wsID+"/abilities",
-		newFakeCloser([]byte(`{"talk_to_user_enabled":true}`)))
-	c.Request.Header.Set("Content-Type", "application/json")
-
-	PatchAbilities(c)
-
-	if w.Code != http.StatusInternalServerError {
-		t.Errorf("got %d, want 500: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-// ── Helpers ────────────────────────────────────────────────────────────────────
-
-// newFakeCloser wraps a byte slice as an io.ReadCloser for request body injection.
-func newFakeCloser(data []byte) *fakeReadCloser {
-	return &fakeReadCloser{data: data}
-}
-
-type fakeReadCloser struct {
-	data []byte
-	pos  int
-}
-
-func (f *fakeReadCloser) Read(p []byte) (n int, err error) {
-	if f.pos >= len(f.data) {
-		return 0, nil
-	}
-	n = copy(p, f.data[f.pos:])
-	f.pos += n
-	return n, nil
-}
-
-func (*fakeReadCloser) Close() error { return nil }

workspace-server/internal/handlers/workspace_broadcast_test.go

@@ -1,403 +0,0 @@
-package handlers
-
-import (
-	"database/sql"
-	"io"
-	"net/http"
-	"net/http/httptest"
-	"strings"
-	"testing"
-
-	"github.com/DATA-DOG/go-sqlmock"
-	"github.com/Molecule-AI/molecule-monorepo/platform/internal/db"
-	"github.com/gin-gonic/gin"
-)
-
-// broadcastBody is a convenience that returns an io.ReadCloser wrapping JSON body.
-func broadcastBody(body string) io.ReadCloser {
-	return &broadcastFakeCloser{data: []byte(body)}
-}
-
-type broadcastFakeCloser struct {
-	data []byte
-	pos  int
-}
-
-func (f *broadcastFakeCloser) Read(p []byte) (n int, err error) {
-	if f.pos >= len(f.data) {
-		return 0, io.EOF
-	}
-	n = copy(p, f.data[f.pos:])
-	f.pos += n
-	return n, nil
-}
-
-func (*broadcastFakeCloser) Close() error { return nil }
-
-// setupBroadcastDB creates a sqlmock DB with QueryMatcherEqual.
-func setupBroadcastDB(t *testing.T) sqlmock.Sqlmock {
-	t.Helper()
-	mockDB, mock, err := sqlmock.New(sqlmock.QueryMatcherOption(sqlmock.QueryMatcherEqual))
-	if err != nil {
-		t.Fatalf("sqlmock.New: %v", err)
-	}
-	prevDB := db.DB
-	db.DB = mockDB
-	t.Cleanup(func() { db.DB = prevDB; mockDB.Close() })
-	return mock
-}
-
-// Exact SQL strings from the production handler (whitespace must match verbatim).
-const (
-	sqlBroadcastWorkspaceLookup = `SELECT name, broadcast_enabled FROM workspaces WHERE id = $1 AND status != 'removed'`
-	sqlBroadcastRecipients     = `SELECT id FROM workspaces WHERE status != 'removed' AND id != $1`
-	sqlBroadcastReceiveInsert  = `
-			INSERT INTO activity_logs (workspace_id, activity_type, method, source_id, summary, status)
-			VALUES ($1, 'broadcast_receive', 'broadcast', $2, $3, 'ok')`
-	sqlBroadcastSentInsert = `
-		INSERT INTO activity_logs (workspace_id, activity_type, method, summary, status)
-		VALUES ($1, 'broadcast_sent', 'broadcast', $2, 'ok')`
-)
-
-// ── Broadcast HTTP handler tests ───────────────────────────────────────────────
-
-func TestBroadcast_InvalidWorkspaceID_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/not-a-uuid/broadcast",
-		broadcastBody(`{"message":"hello"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestBroadcast_MissingMessage_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/broadcast",
-		broadcastBody(`{}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestBroadcast_EmptyMessage_Returns400(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost,
-		"/workspaces/aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa/broadcast",
-		broadcastBody(`{"message":""}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusBadRequest {
-		t.Errorf("got %d, want 400: %s", w.Code, w.Body.String())
-	}
-}
-
-func TestBroadcast_WorkspaceNotFound_Returns404(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnError(sql.ErrNoRows)
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"hello"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusNotFound {
-		t.Errorf("got %d, want 404: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestBroadcast_BroadcastDisabled_Returns403(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
-			AddRow("test-workspace", false))
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"hello"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusForbidden {
-		t.Errorf("got %d, want 403: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestBroadcast_NoRecipients_Success(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
-			AddRow("test-workspace", true))
-
-	// No recipients (sender is the only non-removed workspace)
-	mock.ExpectQuery(sqlBroadcastRecipients).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}))
-
-	// Sender's own activity log: 2 args (workspaceID, summary)
-	mock.ExpectExec(sqlBroadcastSentInsert).
-		WithArgs(wsID, sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"hello everyone"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestBroadcast_WithRecipients_Success_DeliversToAll(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	recipient1 := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	recipient2 := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
-			AddRow("broadcaster-ws", true))
-
-	mock.ExpectQuery(sqlBroadcastRecipients).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).
-			AddRow(recipient1).
-			AddRow(recipient2))
-
-	// broadcast_receive: 3 args (recipientID, senderID, summary)
-	mock.ExpectExec(sqlBroadcastReceiveInsert).
-		WithArgs(recipient1, sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	mock.ExpectExec(sqlBroadcastReceiveInsert).
-		WithArgs(recipient2, sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	// broadcast_sent: 2 args (workspaceID, summary)
-	mock.ExpectExec(sqlBroadcastSentInsert).
-		WithArgs(wsID, sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"hello team"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestBroadcast_RecipientInsertError_ContinuesAndSucceeds(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-	recipient1 := "bbbbbbbb-bbbb-bbbb-bbbb-bbbbbbbbbbbb"
-	recipient2 := "cccccccc-cccc-cccc-cccc-cccccccccccc"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
-			AddRow("broadcaster-ws", true))
-
-	mock.ExpectQuery(sqlBroadcastRecipients).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}).
-			AddRow(recipient1).
-			AddRow(recipient2))
-
-	// First recipient insert fails — handler logs and continues
-	mock.ExpectExec(sqlBroadcastReceiveInsert).
-		WithArgs(recipient1, sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnError(sql.ErrConnDone)
-
-	// Second recipient succeeds
-	mock.ExpectExec(sqlBroadcastReceiveInsert).
-		WithArgs(recipient2, sqlmock.AnyArg(), sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	mock.ExpectExec(sqlBroadcastSentInsert).
-		WithArgs(wsID, sqlmock.AnyArg()).
-		WillReturnResult(sqlmock.NewResult(0, 1))
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"partial delivery"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-func TestBroadcast_SenderActivityLogError_StillReturns200(t *testing.T) {
-	gin.SetMode(gin.TestMode)
-	mock := setupBroadcastDB(t)
-	h := NewBroadcastHandler(newTestBroadcaster())
-
-	wsID := "aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa"
-
-	mock.ExpectQuery(sqlBroadcastWorkspaceLookup).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"name", "broadcast_enabled"}).
-			AddRow("broadcaster-ws", true))
-
-	mock.ExpectQuery(sqlBroadcastRecipients).
-		WithArgs(wsID).
-		WillReturnRows(sqlmock.NewRows([]string{"id"}))
-
-	mock.ExpectExec(sqlBroadcastSentInsert).
-		WithArgs(wsID, sqlmock.AnyArg()).
-		WillReturnError(sql.ErrConnDone)
-
-	r := gin.New()
-	r.POST("/workspaces/:id/broadcast", h.Broadcast)
-
-	req := httptest.NewRequest(http.MethodPost, "/workspaces/"+wsID+"/broadcast",
-		broadcastBody(`{"message":"hello"}`))
-	req.Header.Set("Content-Type", "application/json")
-	w := httptest.NewRecorder()
-	r.ServeHTTP(w, req)
-
-	// Handler logs error but still returns 200
-	if w.Code != http.StatusOK {
-		t.Errorf("got %d, want 200: %s", w.Code, w.Body.String())
-	}
-	if err := mock.ExpectationsWereMet(); err != nil {
-		t.Errorf("unmet sqlmock expectations: %v", err)
-	}
-}
-
-// ── broadcastTruncate pure function tests ─────────────────────────────────────
-
-func TestBroadcastTruncate_UnderLimit(t *testing.T) {
-	input := "short message"
-	got := broadcastTruncate(input, 50)
-	if got != input {
-		t.Errorf("broadcastTruncate(%q, 50) = %q, want %q", input, got, input)
-	}
-}
-
-func TestBroadcastTruncate_ExactlyAtLimit(t *testing.T) {
-	input := "exactly fifty char"
-	got := broadcastTruncate(input, 18)
-	if got != input {
-		t.Errorf("broadcastTruncate(%q, 18) = %q, want %q", input, got, input)
-	}
-}
-
-func TestBroadcastTruncate_OverLimit_TruncatesAndAddsEllipsis(t *testing.T) {
-	// 150 ASCII chars → over 120 rune limit → truncate to 120 + ellipsis
-	input := strings.Repeat("x", 150)
-	got := broadcastTruncate(input, 120)
-	if len([]rune(got)) != 121 { // 120 + 1 ellipsis rune
-		t.Errorf("len(broadcastTruncate) = %d, want 121 (120 + ellipsis)", len([]rune(got)))
-	}
-	if got[:len(got)-len("…")] != strings.Repeat("x", 120) {
-		t.Errorf("broadcastTruncate did not truncate correctly")
-	}
-}
-
-func TestBroadcastTruncate_UnicodeChars_TreatsAsRunes(t *testing.T) {
-	// Each emoji is 1 rune but multiple bytes. 50 emojis > 30 limit.
-	input := strings.Repeat("🎉", 50)
-	got := broadcastTruncate(input, 30)
-	if len([]rune(got)) != 31 { // 30 + ellipsis
-		t.Errorf("len(broadcastTruncate with emoji) = %d, want 31", len([]rune(got)))
-	}
-}
-
-func TestBroadcastTruncate_ZeroLimit_ReturnsEllipsis(t *testing.T) {
-	got := broadcastTruncate("hello", 0)
-	if got != "…" {
-		t.Errorf("broadcastTruncate with max=0 = %q, want …", got)
-	}
-}

workspace-server/internal/handlers/workspace_provision.go

@@ -830,6 +830,21 @@ func loadWorkspaceSecrets(ctx context.Context, workspaceID string) (map[string]s
 			log.Printf("Provisioner: workspace_secrets rows.Err workspace=%s: %v", workspaceID, err)
 		}
 	}
+
+	// Provider BASE_URL fallback (RFC internal#417): when the operator
+	// saved a vendor API key (e.g. MINIMAX_API_KEY) but no matching
+	// <PROVIDER>_BASE_URL, inject the canonical regional URL so the
+	// in-workspace adapter doesn't fall back to its hardcoded default
+	// (which is wrong for at least MiniMax — api.minimaxi.com China vs
+	// api.minimax.io global). Operator-saved URLs win; this only fills
+	// holes. See provider_defaults.go for the registry + precedence.
+	if injected := applyProviderBaseURLDefaults(envVars); len(injected) > 0 {
+		for _, k := range injected {
+			log.Printf("Provisioner: provider BASE_URL fallback applied for %s: %s=%s",
+				workspaceID, k, envVars[k])
+		}
+	}
+
 	return envVars, ""
 }